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Introduction 


Message  from  the  Auditor  General 


Role  of  our  Office 


Message  from  the  Auditor  General 

What  we  do  and  why  we  now  report  semi-annually 

Our  goal  is  to  provide  timely,  useful,  and  relevant  information  to  our  clients  the 
Legislative  Assembly,  and  the  people  of  Alberta.  The  reports  we  give  to  the 
Legislative  Assembly  identity  opportunities  and  propose  solutions  to  improve  the 
use  of  public  resources,  and  improve  and  add  credibility  to  the  government's 
financial  reporting.  We  focus  on  the  assets,  revenues  and  expenses  of  the 
province,  and  government  program  initiatives  that  affect  the  well-being  of 
people. 


Semi-annual  reporting 
more  helpful 


In  April  2008,  we  changed  from  annual  to  semi-annual  reporting  to  help 
government  improve  its  accountability.  There  is  no  reason  to  delay  reporting 
important  recommendations  and  findings  that  need  action.  It  also  allows  the 
Public  Accounts  Committee  to  provide  more  timely  consideration  of  the  issues 
raised  in  our  reports.  By  reporting  more  frequently,  we  also  enhance  our  own 
accountability  for  use  of  public  money.  The  result  is  more  useful  reporting  that 
helps  government  and  informs  the  Legislative  Assembly  and  Albertans. 


Two  numbered 
recommendations 


Improving  the 
processes  to  assess 
and  monitor  research 
related  business 
relationships 


Improving  public 
reporting  of 
performance 


Report  highlights 

In  this  Report,  we  have  made  one  numbered  recommendation  to  the  University  of 
Lethbridge  and  one  numbered  recommendation  to  the  Department  of  Sustainable 
Resource  Dev  elopment.  These  recommendations  require  a  formal  response  from 
government. 

•  Recommendation  No.  1 — University  of  Lethbridge  should  strengthen 
processes  for  assessing  and  monitoring  business  relationships  related  to 
research,  and  periodically  report  key  information  on  risks  to  the  Board  of 
Governors.  Without  adequately  assessing  the  risks  and  benefits  of  research 
projects,  there's  an  increased  risk  of  research  money  not  being  effectively 
used. 

•  Recommendation  No.  2 — Department  of  Sustainable  Resource  Dev  elopment 
should  publicly  report  relevant  and  sufficient  reforestation  performance 
information  to  confirm  the  effectiv  eness  of  regulatory  systems.  Otherwise, 
it's  unclear  if  standards  are  being  complied  with,  or  are  stringent  enough  to 
ensure  satisfactory  reforestation. 
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Message  from  the  Auditor  General 


We  have  also  issued  19  unnumbered  recommendations  to  several  post-secondary 
institutions.  The  sheer  number  of  recommendations,  combined  with  the  fact  that 
many  of  them  relate  to  weaknesses  in  basic  internal  controls  that  expose 
institutions  to  fraud  and  error,  is  a  cause  for  concern.  Also,  some  of  the 
recommendations  focus  on  improving  financial  reporting,  which  can  help 
management  to  better  run  the  institutions,  and  audit  committees  to  provide  more 
effective  oversight. 

The  control  weaknesses  that  we  identified  generally  relate  to  segregation  of 
duties,  timely  reconciliations,  and  access  to  assets  and  information  systems. 
Although  good  internal  controls  do  not  eliminate  the  risk  of  fraud  and  error,  the 
risk  can  be  significantly  reduced  by  ensuring: 

•  incompatible  duties  are  properly  segregated. 

•  reconciliations  are  being  routinely  performed. 

•  access  to  assets  and  information  systems  is  restricted  to  appropriate  staff. 

Two  post-secondary  institutions  have  a  greater  proportion  of  the 
recommendations.  First,  Grant  MacEwan  College  has  four  new 
recommendations.  These,  when  combined  with  past  recommendations, 
demonstrate  that  the  College  has  an  ineffective  control  environment  for  an 
institution  of  its  size.  The  College  needs  to  solve  its  staffing  and  systems 
information  issues,  and  its  internal  control  weaknesses.  Until  it  resolves  these 
issues,  the  College  continues  to  be  unnecessarily  exposed  to  risks  of  fraud  and 
error.  On  page  81  and  84,  we  refer  to  management  informing  us  of  three  forensic 
investigations. 

Bow  Valley  College      Second,  Bow  Valley  College  has  six  new  recommendations.  The  College 

informed  us  of  an  alleged  fraud  in  November  2008.  As  a  result,  we  audited  the 
processes  the  College  used  in  its  investigation,  and  the  College's  related  internal 
control  systems.  Our  audit  produced  five  recommendations  and  demonstrated 
that  the  College  could  make  significant  improvements  in  its  contracting 
processes.  However,  we  commend  the  College  for  advising  our  Office  in  a  timely 
manner,  conducting  a  thorough  and  effective  investigation,  and  committing  to 
make  the  necessary  changes  to  improve  its  systems. 

In  the  current  economic  climate,  effective  internal  controls  are  even  more  critical 
because  of  increased  pressures  in  meeting  budgets  and  reduced  investment 
income  to  fund  operations. 


Weak  internal 
controls  increase  the 
risk  of  fraud  and  error 


Grant  MacEwan 
College 
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Understanding  the 
province's  financial 
reporting 


In  June,  we  will  report  on  the  consolidated  financial  statements  of  the  province 
for  the  fiscal  year  ended  March  3  I.  2009.  This  Report  includes  a  chapter  called. 


Alberta's  consolidated  financial  statements,  where  we  discuss  several  topics  that 
are  important  in  understanding  Alberta's  consolidated  financial  statements.  Our 
goal  is  to  promote  a  better  understanding  of  the  pro\  ince's  financial  affairs. 

Acknowledgement  and  thanks 

I  am  grateful  to  the  following  parties  and  thank  them  for  their  advice, 
suggestions,  and  support. 

Members  of  the  Legislative  Assembly,  in  particular  members  of  the  Standing 
C  ommittee  on  Public  Accounts  who,  through  their  suggestions,  identify  audits 
that  would  help  them  do  their  work  as  legislators. 

Members  of  the  public,  who  contact  us  with  concerns  about  government  sv  stems. 
They  help  us  to  plan  the  focus  of  our  future  audit  work. 

Members  of  the  Prov  incial  Audit  Committee,  who  prov  ide  vv  ise  counsel.  This 
group  of  senior  business  executives  with  financial,  business  and  gov  ernance 
skills  has  an  important  advisory  role  to  government  and  our  Office. 

The  organizations  that  we  audit,  whose  cooperation  is  fundamental  to  our 
success.  Senior  management  and  board  members  of  audited  organizations  meet 
with  us  to  discuss  our  audit  plans,  findings,  and  recommendations.  They  give  us 
the  necessary  information,  reports,  and  explanations  to  our  questions. 

Various  advisors,  who  contribute  their  expertise  to  help  us  complete  our  major 
systems  audits. 

Finally,  I  thank  my  staff — and  the  agent  firms  they  work  with — for  their 
thorough  and  professional  work.  They  are  dedicated  to  objective  and 
cost-effective  auditing.  The  audits  and  issues  that  they  deal  with  are  challenging 
and  often  sensitive,  but  are  important  for  the  members  of  the  Legislativ  e 
Assembly  and  the  people  of  Alberta.  I  believe  that  effective  auditing  is  always 
important,  however,  in  a  period  of  economic  difficulty  and  restraint,  effective 
independent  and  objective  auditing  becomes  even  more  important. 


Fred  J.  Dunn,  FCA 
Auditor  General 


April  6,  2009 
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Recommendation  highlights 

This  Report  contains  22  recommendations,  all  listed,  starting  at  page  7.  We  have 
numbered  two  recommendations  that  need  a  formal  response  from  the  government. 
Of  the  tw  o  numbered  recommendations,  one  is  new  .  and  the  other  one  repeals  .1 
previous  recommendation  where  implementation  progress  was  too  slow.  By 
repeating  this  recommendation,  we  expect  the  government  to  formally  recommit  to 
its  implementation. 

Prioritizing  our  recommendations 

As  part  of  the  audit  process,  we  prov  ide  recommendations  to  gov  ernment  in 
documents  called  management  letters.  We  use  our  public  reporting  to  bring  our 
recommendations  to  the  attention  of  Members  of  the  Legislative  Assembly  (MLAs). 
For  example,  members  of  the  all-party  Standing  Committee  on  Public  Accounts 
refer  to  the  recommendations  in  our  public  reports  during  their  meetings  with 
representativ  es  of  government  ministries  and  agencies. 

To  help  MLAs,  we  prioritize  recommendations  in  our  public  reports  to  indicate 
w  here  we  believe  they  should  focus  their  attention.  We  categorize  them  as  follows: 

•  Key  recommendations — these  are  the  numbered  recommendations  w  e  believe 
are  the  most  significant.  By  implementing  these  recommendations,  the 
government  will  significantly  improve  the  safety  and  welfare  of  Albertans,  the 
security  and  use  of  the  prov  ince's  resources,  or  the  governance  and  ethics  with 
which  government  operations  are  managed. 

•  Numbered  recommendations — these  recommendations  require  a  formal 
response  from  the  government. 

•  Unnumbered  recommendations    these  recommendations,  although 
important,  do  not  require  a  formal  response  from  government. 

Reporting  the  status  of  recommendations 

We  follow  up  all  recommendations  and  report  their  status  in  our  public  reports.  The 
timing  of  our  follow-up  audits  depends  on  the  nature  of  our  recommendations.  To 
encourage  timely  implementation,  and  assist  with  the  timing  of  our  follow-up 
audits,  we  require  a  reasonable  implementation  timeline  on  all  recommendations 
accepted  by  the  government  or  the  entities  we  audit.  We  recognize  some 
recommendations  will  take  longer  to  fully  implement  than  others  but  we  encourage 
full  implementation  within  three  years.  Typically,  we  do  not  report  on  the  progress 
of  an  outstanding  recommendation  until  management  has  had  sufficient  time  to 
implement  the  recommendation  and  we  have  completed  our  follow-up  audit  work. 
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The  status  of  our  recommendations  is  reported  as  follows: 

•  Implemented — we  briefly  explain  how  the  government  implemented  the 
recommendation. 

•  Repeated — we  explain  why  we  are  repeating  the  recommendation  and  what  the 
government  must  still  do  to  implement  the  recommendation. 

•  Progress  report — we  provide  information  when  we  consider  it  useful  for  MLAs 
to  understand  management's  actions. 

•  Satisfactory  progress  report — we  may  want  to  state  that  progress  is  satisfactory 
based  on  the  results  of  a  follow-up  audit. 

•  Changed  circumstance — if  the  recommendation  is  no  longer  valid,  we  briefly 
explain  why. 

Outstanding  recommendations 

We  have  a  chapter  called  Outstanding  recommendations — see  page  107.  It  provides 
a  complete  list  of  the  recommendations  that  are  not  yet  implemented.  Although 
management  may  consider  some  of  these  recommendations  implemented,  we  do  not 
remove  recommendations  from  the  list  until  we  have  been  able  to  complete 
follow-up  audit  work  to  confirm  implementation. 
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April  2009  recommendations 


s  — Indicates  a  ke\  recommendation 


Green  print — numbered  recommendations 
Black  print — unnumbered  recommendations 


Systems  audits 


Bow  Valley  College — Contracting  in  the  International  Education  and  Workplace 
Training  Department 

Page  16    Contract  reviews — Recommendation 

We  recommend  that  Bow  Valley  College  develop  a  process  to  ensure  personal  services  contracts  are 
reviewed  before  departments  initiate  them  to  ensure  all  contracts  are  valid. 

Page  IS    Contracting  processes — Recommendation 

We  recommend  that  Bow  Valley  College  ensure  it  has  an  appropriate  personal  services  vendor  selection 
method  to  evaluate  potential  vendors. 

Page  \9    Vendor  maintenance — Recommendation 

We  recommend  that  Bow  Valley  College  improve  its  controls  for  setting  up  new  vendors  by  requiring  that 
vendor  change  requests  be  appropriately  approved. 

I 'aye  20    Processing  of  contract  payments — Recommendation 

We  recommend  that  Bow  Valley  College  improve  internal  controls  for  processing  contract  payments  by 
ensuring  proper  segregation  of  incompatible  duties,  and  proper  authorization  of  vendor  invoices. 

Page  21     Unethical  conduct  in  the  workplace? — Recommendation 

We  recommend  that  Bow  Vallc\  College  improve  processes  for  dealing  with  unethical  conduct  in  the 
w  orkplace  by  clearly  defining  and  communicating  to  staff  the  responsibilities  and  actions  required  in  the 
event  of  such  conduct. 

University  of  Lethbridge — Research  Investment — Alberta  Terrestrial  Imaging  Corp. 
(ATIC) 

Page  26    Improve  processes  for  investing  in  research  projects — Recommendation  No.  1 
W  e  recommend  the  University  of  Lethbridge: 

•  strengthen  processes  for  assessing  risks  and  benefits  relating  to  prospective  business  relationships. 

•  strengthen  processes  to  oversee  and  monitor  financial  and  other  risks  throughout  the  life  of  business 
relationships. 

•  periodically  report  to  the  Board  of  Governors  key  information  on  financial  and  other  risks  in  research 
management. 

Reforestation — Follow-up 

Page  52     Performance  information — Recommendation  No.  2 — repeated 

We  again  recommend  that  the  Department  of  Sustainable  Resource  Development  publicly  report  relevant 
and  sufficient  reforestation  performance  information  to  confirm  the  effectiveness  of  its  regulatory  systems. 
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Advanced  Education  and  Technology 

Page  78    Preserving  endowment  assets — Recommendation 

We  recommend  that  the  following  Institutions  define  their  goals  for  the  use,  and  preservation  of  the 
economic  value  of  endowment  assets  (inflation  proofing): 
Alberta  College  of  Art  and  Design  (ACAD) 
Grande  Prairie  Regional  College 
Keyano  College 
Lakeland  College 
Lethbridge  Community  College 
Medicine  Hat  College 
Mount  Royal  College 
NorQuest  College 
Olds  College 
Portage  College 
Red  Deer  College 

Page  82    Grant  MacEwan  College — Parking  services  fees — Recommendation 

We  recommend  that  Grant  MacEwan  College  improve  its  systems  to  control,  collect,  and  account  for  parking 
services  fees. 

Page  83    Grant  MacEwan  College — Sports  and  Wellness  Centre — Recommendation 

We  recommend  that  Grant  MacEwan  College: 

•  establish  policies  and  procedures  for  issuing  complimentary  memberships  and  discounts  for  using  the 
Sports  and  Wellness  Centre  facilities. 

•  improve  its  system  to  control  and  safeguard  cash  collected  at  sporting  events. 

Page  84    Grant  MacEwan  College — Prompt  completion  of  sub-ledger  reconciliations — Recommendation 

We  recommend  that  Grant  MacEwan  College  promptly  reconcile  sub-ledgers  to  the  general  ledger  to  ensure 
it  records  all  transactions  accurately. 

Page  85    Grant  MacEwan  College — Capital  assets — Recommendation 

We  recommend  that  Grant  MacEwan  College  improve  its  capital  asset  processes  by: 

•  documenting  its  assessment  on  the  appropriate  accounting  treatment  for  costs  related  to  construction 
and  renovation  projects. 

•  coding  and  recording  transactions  accurately  the  first  time. 

Page  87    NorQuest  College — Internal  controls  over  cash — Recommendation 

We  recommend  that  NorQuest  College  improve  its  controls  over  cash  received  from  tuition  and  student  fees. 

Page  88    NorQuest  College — Procurement  cards — discrepancy  log — Recommendation 

We  recommend  that  NorQuest  College  improve  controls  to  ensure  that  procurement  cardholders  comply  with 
its  procurement  card  policy. 

Page  89    NorQuest  College — Procurement  cards — compliance  with  procurement  card  policy — 
Recommendation 

We  recommend  that  NorQuest  College  ensure  that  its  procurement  card  statements  are  supported  by 
adequate  documentation  and  are  approved  by  an  authorized  individual  before  making  payments. 
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Page  90    Northern  Alberta  Institute  of  Technology — Review  of  procurement  card  transactions 
Recommendation 

We  recommend  that  the  Northern  Alberta  Institute  of  Technology  improve  its  processes  to  re\  iew  and 
approve  staffs  procurement  card  transactions. 

Page  91     Lakeland  College — Improve  payroll  controls — Recommendation 

We  recommend  that  Lakeland  College: 

•  adequately  segregate  staff  access  to  the  PeopleSoft  payroll  system  to  ensure  onh  \alid  changes  are 
made. 

•  review  change  reports  generated  from  the  pay  roll  system  for  appropriateness. 

•  prepare  monthly  reconciliations  of  the  pay  roll  system  to  the  general  ledger  and  promptly  review  the 
reconciliations. 

Page  92     Lakeland  College — Segregation  of  duties  over  journal  entries — Recommendation 

We  recommend  that  Lakeland  College  properly  segregate  the  incompatible  functions  of  preparing  and 
approving  journal  entries. 

Page  93    Mount  Royal  College — Segregation  of  payroll  duties — Recommendation 

We  recommend  that  Mount  Royal  College  adequately  segregate  duties  for  processing  payments  to  casual  and 
contract  employees. 

Page  94    Bow  Valley  College — Quarterly  financial  reporting — Recommendation 

We  recommend  that  Bow  Valley  College  improve  its  financial  reporting  to  the  Board  by: 

•  including — at  least  quarterly — complete  statements  of  financial  position,  changes  in  net  assets  and 
actual  year-to-date  operating  results. 

•  improving  its  quarterly  processes  and  controls  to  ensure  accurate  financial  information. 

Page  95    Medicine  Hat  College— Periodic  reporting  to  the  Board  Recommendation 

We  recommend  that  Medicine  Hat  College  improve  its  financial  reporting  to  its  Board  by  including — at  least 
quarterly — complete  statements  of  operations,  financial  position  and  changes  in  net  assets. 

Alberta  Capital  Finance  Authority 

Additional  skilled  resources  required — Recommendation 

Page  103  We  recommend  that  management  of  Alberta  Capital  Finance  Authority  secure  additional  skilled  resources  to 
help  implement  new  required  financial  accounting  standards  and  to  ensure  the  cost-effect i\ e  preparation  and 
management  review  of  its  annual  financial  statements. 
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Bow  Valley  College — Contracting  in  the 
International  Education  and  Workplace  Training  Department 


College  finds 
funds  u  ere 
inappropriately 
diverted 


College  has 
internal  control 
weaknesses  in 
personal  services 
contracting 


Bow  Valley  College — Contracting  in 
the  International  Education  and 
Workplace  Training  Department 

1.  Summary 

What  we  examined 

Bow  Valley  College  (the  College)  informed  us  of  an  alleged  fraud'  by  a  senior 
employee"  that  took  place  from  July  2005  to  November  2008.  The  College 
alleges  that  approximately  $189,000  was  diverted  to  businesses  operated  or 
controlled  directly  or  indirectly  by  the  employee.  The  College  investigated  and 
referred  the  matter  to  the  local  police  authority,  which  is  presently  conducting  a 
criminal  investigation.  We  commend  the  College  for  advising  our  Office  in  a 
timely  manner  and  conducting  an  effective  and  thorough  investigation. 

Our  examination  focused  on  the  International  Education  and  Workplace 
Training  Department  (1ED)  and  the  processes  surrounding  the  alleged 
inappropriate  activity  and  the  transactions  involved.  We  did  not  do  a  complete 
review  of  the  College's  internal  controls  ov  er  contracting  processes.  Our 
examination  focused  on  processes  within  which  the  alleged  fraudulent  activities 
occurred.  However,  we  expanded  our  work  to  include  broader  internal  control 
processes  when  necessary. 

Why  is  it  important  to  Albertans 

Albertans  need  to  know  that  the  College  safeguards  and  uses  public  funds 
appropriately. 

What  we  found 

Weaknesses  in  the  College's  system  of  internal  controls  enabled  the  Director  to 
allegedly  prepare  and  submit  inv  oices  for  payment  of  commissions  to 
businesses  controlled  directly  or  indirectly  by  him  pursuant  to  contracts  for 
which  no  services  were  prov  ided.  The  Director  could  initiate  and  approv  e 


Specific  allegations  are  contained  in  a  Statement  of  Claim  filed  November  26.  2008.  with  the  Court  of  Queen's  Bench  of 
Alberta  in  the  Judicial  District  of  Calgary  as  Action  No.:  0X01-14764. 

"  The  Director  of  the  International  Education  and  Workplace  Training  Department  at  the  College  w  as  terminated  in 
November  2008.  Throughout  this  report,  we  refer  to  him  as  the  Director. 
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personal  services  contracts  without  any  secondary  review,  initiate  and  approve 
new  vendors  in  the  computer  systems,  initiate  and  approve  invoices,  and 
arrange  to  have  the  payment  hand  delivered  to  his  department.  We  identified 
opportunities  for  management  to  improve  internal  controls  over  contracts, 
vendor  maintenance  and  payment  processing,  and  improve  processes  for 
dealing  with  unethical  conduct  in  the  workplace. 


We  recommend 
changes  to  the 
College's  system 
of  internal 
controls 


What  the  College  needs  to  do 

The  College  needs  to  develop  a  process  to  review  contracts  before  its 
departments  sign  them  to  ensure  the  contracts  are  valid.  The  College  also  needs 
to  improve  existing  processes  to  ensure  it  has  an  appropriate  personal  services 
vendor  selection  method  to  evaluate  potential  vendors. 


The  College  has  inadequate  controls  over  vendor  maintenance,  and  needs  to 
improve  its  processing  of  contract  payments.  It  should  also  ensure  that 
responsibilities  and  actions  for  dealing  with  unethical  conduct  are  clearly 
defined  and  communicated  to  staff.  By  improving  its  controls,  the  College 
could  significantly  limit  the  risk  of  fraud. 


2.  Audit  objectives  and  scope 


College  conducted 
an  investigation 
and  concluded  that 
funds  were 
diverted 


College  management  was  informed  by  certain  staff  that  they  had  concerns 
about  some  personal  service  contracts  in  late  2008.  The  College  investigated 
and  concluded  that  commissions  were  paid  pursuant  to  contracts  for  which  no 
services  were  provided  to  the  College.  Our  objectives  were  to: 

•  review  the  processes  the  College  used  in  its  investigation. 

•  review  internal  control  processes  that  failed  to  prevent  or  detect  the  alleged 
inappropriate  activity. 


We  examined 
processes 
surrounding  the 
alleged 
improprieties 


We  documented  the  processes  involving  personal  services  contracts,  vendor 
maintenance  and  payment  processing  within  the  context  of  the  alleged 
inappropriate  activity.  We  interviewed  key  employees  and  performed 
walkthroughs  when  necessary.  We  did  not  examine  any  financial  processing  or 
information  technology  controls  beyond  the  scope  of  the  alleged  conduct  within 
IED.  Nor  did  we  review  the  College's  general  processes  for  contract 
accountability  and  monitoring,  examine  contracts  that  other  College 
departments  administer,  or  review  the  processes  for  the  procurement  of  goods 
or  other  services.  Due  to  concerns  at  IED,  we  did  however  examine  processes 
used  College-wide  for  personal  services  contracts. 
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3.  Background 


The  College  is  a  post-secondary  institution  serving  primarily  the 

City  of  Calgary  and  communities  in  southern  Alberta.  It  provides  instruction 

and  training  to  assist  adult  learners  through: 

•  academic  upgrading. 

•  career  entry  training  in  business. 

•  health  and  service  industries. 

•  English  as  a  second  language. 


Il  l),  a  College 

department. 

develops 

strategies  to 

recruit 

international 

students 


Operating  within  the  College  is  the  International  Education  and  Workplace 
Training  Department.  One  purpose  of  IED  is  to  develop  strategies  to  recruit 
international  students  for  the  College.  International  students  enroll  at  the 
College  by  either: 

•  using  an  agent  to  assist  w  ith  all  or  part  of  the  enrolment  process  and 
obtaining  the  appropriate  government  visas;  or 

•  dealing  directly  with  the  College  (without  using  an  agent  to  complete  all 
applications  and  requirements). 


Agents  contracted 
by  IED  enter  into 
contracts  with  the 
College 


Prospective  agents  must  enter  into  a  personal  services  contract  w  ith  the 
College.  Personal  services  contracts  with  agents  are  authorized  by  the  IED 
Director,  unless  the  contract  amount  exceeds  $50,000.  In  that  case,  the 
appropriate  Vice  President  authorizes  the  contract.  The  College  pays  the  agent 
for  serv  ices  prov  ided  based  on  a  fee  schedule. 


Contract 
relationships 
appeared 
suspicious 


The  College  advised  us  that,  during  2008,  IED  staff  expressed  concerns  about 
certain  contracts  approved  by  the  Director.  In  October  2008.  the  College 
investigated  processes  used  for  these  contracts  in  IED.  The  investigation 
discov  ered  the  alleged  inappropriate  activity. 


Our  Office  was 
notified  after  the 
College  conducted 
an  investigation 


The  College  notified  us  in  November  2008  and  asked  us  to  review  then- 
investigation  to  date  and  provide  feedback  and  advice.  We  commend  the 
College  for  its  efforts  in  handling  this  matter  most  professionally  b\  effectively 
investigating,  involving  us  early  in  the  investigation,  and  fully  cooperating 
during  our  examination. 
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Director  had 
control  of  the 
process  for 
personal  services 
contracts 


4.  Audit  findings  and  recommendations 

The  College  alleges  that  approximately  $  1 89,000  in  commission  payments  for 
international  students  not  represented  by  an  agent  was  diverted  to  parties 
directly  or  indirectly  controlled  by  the  Director.  We  determined  that  the  College 
completed  a  thorough  and  detailed  investigation.  Due  to  weaknesses  in  the 
College's  internal  controls,  the  Director  was  able  to: 

•  initiate  and  approve  personal  services  contracts  without  any  secondary 
review. 

•  initiate  and  approve  vendor  maintenance  requests. 

•  initiate  and  approve  invoices. 

•  arrange  for  hand  delivery  of  payment  in  the  form  of  cheques  to  his 
department. 


We  found 
significant  internal 
control 
weaknesses 


We  reviewed  key  processes  within  the  scope  of  the  alleged  inappropriate 
activity  in  IED.  However,  we  extended  our  work  to  include  College-wide 
internal  control  processes  when  necessary.  As  a  result,  our  work  identified 
broader  weaknesses  in  the  College's  systems  of  internal  control. 


4.1  Contract  reviews 
Recommendation 

We  recommend  that  Bow  Valley  College  develop  a  process  to  ensure 
personal  services  contracts  are  reviewed  before  departments  initiate  them 
to  ensure  all  contracts  are  valid. 


College  policy 
enables  deans  and 
directors  to  initiate 
contracts  and 
approve  invoices 
up  to  $50,000 


Background 

The  International  Education  and  Workplace  Training  Department  (IED)  enters 
into  personal  services  contracts  to  acquire  agent  services  for  the  College. 
College  departments  are  responsible  for  identifying  a  need  and  ensuring  that 
budgeted  funds  are  available.  The  College's  policy  authorizes  deans  and 
directors  "to  approve  any  changes  within  the  total  approved  budgets  for  their 
department  and  for  all  budget  transfers  within  their  department"  up  to  certain 
signing  limits  depending  on  the  nature  of  the  transaction.  The  signing  authority 
limit  is  $50,000,  enabling  deans  and  directors  to  initiate  and  approve  contracts 
under  this  amount  without  a  separate  review.  Deans  and  directors  can  also 
approve  supplies  and  services  requisitions  up  to  $50,000.  Deans  and  directors 
are  responsible  to  ensure  the  terms  and  conditions  of  the  contract  are  met  before 
payment  is  authorized. 
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Use  of  standard 
contracting 
template 
encouraged,  but 
not  required 


Although  policy  does  not  require  departments  to  use  a  standardized  contract 
template  developed  by  legal  counsel,  the  College  strongly  encourages 
departments  to  use  it.  The  College  expects  its  HR  department  and  legal  counsel 
to  review  deviations  from  the  template  before  a  contract  is  finalized.  This  is  to 
prevent  the  College  from  agreeing  to  unreasonable  or  imprudent  terms  and 
conditions. 


Criteria:  the  standards  we  used  for  our  audit 

The  College  should: 

•  have  internal  controls  to  ensure  all  contracts  are  valid,  consistent  w  ith 
College  objectives  and  are  associated  with  proper  vendors. 

•  control  the  process  for  using  the  standardized  contract  template  and  for 
amending  it. 


Director  initiated 
and  approved 
contracts  relating 
to  alloyed 
inappropriate 
activity 


Our  audit  findings 

The  College  did  not  review  contracts  before  the  [ED  Director  signed  them.  As  a 
result,  the  Director  had  the  authority  to  sign  all  contracts  up  to  $50,000  without 
any  separate  approvals.  College  policy  enabled  the  Director  to  allegedly 
establish  a  scheme  to  invoice  the  College  for  a  commission  fee  payable  to 
businesses  operated  or  controlled  directly  or  indirectly  by  him.  when  no  such 
commissions  were  owing.  College  management  advised  us  that  departments 
can  initiate  and  approve  contracts  up  to  $50,000  if  there  is  an  apparent  need  and 
budgeted  funds  are  available  to  cover  the  expected  expenditures. 


Director  changed 
contract  terms  in 
the  standard 
contract  template 
without  a 
secondary  review 


IED  did  not  follow  the  typical  guidelines  other  College  departments  follow 
\\  hen  entering  into  personal  services  contracts  w  ith  vendors.  The  Director 
initiated  contracts  with  agents  of  international  students  that  included  terms  and 
conditions  different  from  those  of  the  standard  contract  template.  The 
deviations  in  certain  contracts  the  Director  signed  were  never  rev.  icu  ed  or 
approved  to  ensure  the  College  was  aware  of  and  had  approved,  the  terms  for 
paying  commissions  to  these  agents.  We  were  advised  by  the  College  that  the 
Director  kept  all  signed  personal  services  contracts  with  these  agents  in  an  III) 
file  and  did  not  share  the  final  contracts  with  other  departments.  The  Finance 
Department  processed  the  vendor  invoices  without  hav  ing  copies  of  these 
contracts,  so  it  could  not  match  the  payments  to  the  contract. 

An  effective  control  process  would  define  separate  roles  for  initiating  and 
approving  contracts. 
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Implications  and  risks  if  recommendation  not  implemented 

College  departments  may  sign  invalid  contracts  inconsistent  with,  or  contrary 
to,  the  College's  objectives.  Contracts  may  not  provide  value  for  money  or  may 
be  used  to  commit  fraud. 

4.2  Contracting  processes 
Recommendation 

We  recommend  that  Bow  Valley  College  ensure  it  has  an  appropriate 
personal  services  vendor  selection  method  to  evaluate  potential  vendors. 


I  ED  used  informal 
contractor 
selection  process 


Background 

The  International  Education  and  Workplace  Training  Department  (I  ED)  used  an 
informal  method  to  contract  with  agents.  Agent  vendors  either  contacted  the 
College  to  become  an  approved  vendor  or  were  often  hired  based  on  internal 
"word  of  mouth".  This  resulted  in  a  listing  of  approximately  forty  approved 
agent  vendors. 


Criteria:  the  standards  we  used  for  our  audit 

The  College  should  have  an  adequate  process  to  evaluate  service  providers  and 
vendors  before  signing  a  contract  with  them.  A  best-practice  approach  to 
contracting  should  include: 

1 .  An  appropriate  contractor  selection  method  is  chosen. 

2.  Competition  is  open,  fair,  and  gets  good  value. 

3.  Proposals  are  evaluated  fairly  against  predetermined  criteria. 


College  policy 
silent  on  proper 
process 


Our  audit  findings 

College  policies  did  not  provide  guidance  to  departments  on  the  proper  process 
for  contractor  selection.  As  a  result,  IED  did  not  use  an  appropriate  method  to 
evaluate  agent  vendors.  Our  interviews  with  staff  revealed  that  the  desired 
method  for  evaluating  agents  is  to  require  them  to  complete  a  proposal  for 
contract.  But  nearly  all  personal  services  contracts  in  IED  were  prepared 
without  a  proper  proposal  process.  Only  1  of  13  personal  services  contract  files 
related  to  these  agents  we  tested  had  a  completed  proposal  form.  Staff  said  that 
an  informal  process  was  generally  used  for  these  contracts. 


Implications  and  risks  if  the  recommendation  not  implemented 

Without  an  appropriate  vendor  selection  method,  the  College  may  not  get  the 
best  value  for  money  and  may  risk  fraudulent  activity. 
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4.3  Vendor  maintenance 
Recommendation 

We  recommend  that  Bow  V  alley  College  improve  its  controls  for  setting  up 
new  vendors  by  requiring  that  vendor  change  requests  be  appropriately 
appro\ed. 


Finance  routinely 
makes  vendor 
changes 


Background 

The  College  uses  the  Agresso  financial  system  to  record  collections,  pay 
invoices,  and  report  its  financial  results.  College  Finance  staff  set  up  new 
vendors  in  Agresso  and  edit  vendor  information  in  the  system  to  properly  pay 
vendors.  Finance  staff  make  these  changes  when  departments  request  them. 


Segregation  of 
duties  should  exist 


A  common  control  in  good  control  environments  is  to  have  one  person  initiate  a 
change  and  then  have  a  different  person  approve  the  change. 


Criteria:  the  standards  we  used  for  our  audit 

The  College  should  have  an  adequate  system  for  creating  and  changing  vendor 
information  that  mitigates  the  risk  of  setting  up  inappropriate  or  fictitious 
\  endors. 


Vendor  changes 
do  not  go  through 
a  secondary 
review 


Our  audit  findings 

College  policy  authorizes  Finance  to  set  up  a  vendor  file  in  Agresso  with  only  a 
submitted  fec-for-service  invoice  if  it  is  under  $5,000  and  approv  ed  by  a 
department  staff  member  with  the  appropriate  signing  authority  .  Finance  does 
not  require  a  signed  contract  to  set  up  a  new  vendor,  nor  does  it  require  a 
second  staff  member  to  approve  the  addition  of  a  vendor.  Any  later  invoices 
submitted  for  an  established  v  endor,  regardless  of  amount,  w  ill  be  processed  if 
approved  by  a  department  staff  member  with  the  appropriate  signing  authority. 


Due  to  this  weakness  in  vendor  maintenance  controls,  the  Director  could 
initiate  and  approve  new  vendors.  The  first  invoice  for  each  vendor  was  less 
than  the  $5,000  threshold  per  invoice,  thus  av  oiding  the  requirement  of  a 
separate  authorization.  The  Director  could  then  request  later  invoices  he 
processed  for  these  vendors  up  to  his  authorized  $50,000  signing  limit. 


Implications  and  risks  if  recommendation  not  implemented 

Without  more  effective  controls  to  create  and  change  vendors  in  the  master 
vendor  file,  the  College  risks  fictitious  or  inappropriate  vendors  being  set  up 
and  funds  being  diverted. 
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4.4  Processing  of  contract  payments 
Recommendation 

We  recommend  that  Bow  Valley  College  improve  internal  controls  for 
processing  contract  payments  by  ensuring  proper  segregation  of 
incompatible  duties,  and  proper  authorization  of  vendor  invoices. 


Finance  processes 
contract  payments 


Background 

While  each  department  is  responsible  for  entering  into  and  signing  contracts. 
Finance  is  responsible  for  processing  contract  payments.  Departments  are 
responsible  for  authorizing  contracts,  approving  contract  invoices  and 
forwarding  them  to  Finance  for  processing.  Finance  ensures  invoices  are 
approved  by  a  person  with  the  proper  signing  authority  and  then  processes 
payments. 


Criteria:  the  standards  we  used  for  our  audit 

The  process  for  paying  invoices  should  include  control  mechanisms  such  as 
segregation  of  duties  and  proper  authorization. 


I  ED  generates 
invoices  for  their 
vendors 


Our  audit  findings 

Finance  processes  payments  for  internally  generated  vendor  invoices.  IED 
generates  vendor  invoices  for  agency  contracts  when  vendors  ask  its  staff  to  do 
so.  This  process  is  inappropriate.  From  these  payment  requests,  IED  staff 
calculate  the  amount  owed  to  the  vendor  based  on  records  in  the  computer 
system  and  prepare  the  invoice  for  payment.  For  most  invoices,  a  staff  person 
signed  as  invoice  preparer  and  the  Director  provided  the  approval.  The  invoices 
are  then  forwarded  to  Finance  for  payment.  Finance  was  not  given  the  contract 
or  supporting  documentation  for  the  invoice,  so  it  could  not  compare  this 
information  with  the  IED  internally  generated  vendor  invoice. 


Director  initiated 
and  approved 


invoices 


The  College  alleges  the  Director  was  the  initiator  (preparer)  and  approver  of 
invoices  for  commissions  payable  to  businesses  operated  or  controlled  directly 
or  indirectly  by  him,  when  the  Director  knew  that  no  such  commissions  were 
owing.  For  these  invoices,  the  "prepared  by"  section  of  the  invoice  remained 
unsigned  and  the  Director  signed  only  the  "approved  by"  section.  Finance 
processed  the  payment  for  these  invoices.  Our  interviews  with  Finance  staff 
revealed  that  they  issued  payment  because  a  person  with  the  proper  signing 
authority  signed  the  invoices.  An  effective  control  system  would  ensure  that 
there  is  proper  segregation  between  the  generation  and  approval  of  an  invoice. 


0 
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Pa>  ments  w  ere 
delivered  to  the 
Director 


The  Director  requested  cheques  payable  to  the  entities  used  in  the  alleged 
scheme,  to  be  hand  delivered  to  his  department  in  sealed  envelopes.  Our 
interviews  with  Finance  staff  revealed  thai  the)  were  unaware  of  unusual 
dealings  for  these  contract  payments.  An  effective  control  system  would  ensure 
cheques  arc  not  delivered  to  the  invoice  approver. 


Implications  and  risks  if  recommendation  not  implemented 

[f  the  College  does  not  improve  the  controls  for  processing  contract  payments. 
\  endors  may  be  paid  for  services  not  provided  and  payments  may  go  to 
fictitious  or  inappropriate  vendors,  or  both. 

4.5  Unethical  conduct  in  the  workplace 
Recommendation 

We  recommend  that  Bow  Valley  College  improve  processes  for  dealing 
with  unethical  conduct  in  the  workplace  by  clearly  defining  and 
communicating  to  staff  the  responsibilities  and  actions  required  in  the 
ev  ent  of  such  conduct. 


College  has 
policies  tor  ethical 
business  practices 
and  Code  of 
Conduct 


Background 

The  College  has  an  Ethical  Business  Practices  policy  (the  Ethics  Policy)  that 
specifically  refers  to  fraudulent  acts  and  requires  all  employees  to  report 
allegations  of  fraud  or  other  irregular  activities.  The  College  also  has  a  Code  of 
( 'onduct  (the  Code)  that  deals  specifically  with  intimidation,  harassment,  and 
violence  in  the  workplace.  The  Code  has  detailed  procedures  to  report  a  breach 
of  the  Code,  w  hich  body  to  report  to,  and  what  investigative  steps  follow. 


Criteria:  the  standards  we  used  for  our  audit 

College  guidance  should  include  sufficient  detail  for  employees  to  understand 
how  to  report  a  breach  of  the  Ethics  Policy  and  w  hat  investigative  steps  w  ill 
follow.  It  should  also  attempt  to  protect  employees  w  ho,  in  good  faith,  report 
suspicious  activities.  The  College  should  regularly  make  its  employees  aware  of 
its  Ethics  Policy. 


College's  policy 
on  ethical  business 
practices  is  silent 
on  critical  matters 
such  as  reporting 
irregular  activities 


Our  audit  findings 

The  Ethics  Policy  does  not  provide  a  way  to  report  irregular  activities.  Nor  does 
it  attempt  to  provide  protection  to  staff  w  ho  report  problems.  It  also  does  not 
refer  to  specific  training  or  other  methods  to  make  employees  aware  of  the 
Policy.  Interv  iews  of  College  employees  revealed  that  employees  suspected 
irregular  activity  for  I  ED  agent  contracts  much  earlier  in  2008,  long  before  the 
October  2008  investigation.  These  employees  were  unsure  of  how  to  report  the 
allegations  and  were  concerned  about  their  job  security.  It  was  not  until  later  in 
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2008  that  the  allegations  came  to  light,  when  HR  and  the  Vice  President, 
College  Services  interviewed  these  employees  on  another  matter. 

Implications  and  risks  if  recommendation  not  implemented 

Insufficient  guidance  and  protection  for  employees  may  result  in  unreported 
fraud  or  other  inappropriate  activities. 
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Examined 
University's 
decision  to  form 
ATIC  and  the 
ongoing  oversight 
of  it 


Information  to 
Board  incomplete 


Monitoring  of 
ATIC  coufd 
improve 


University  of  Lethbridge — Research 
Investment — Alberta  Terrestrial 
Imaging  Corp.  (ATIC) 

1.  Summary 

What  we  examined 

We  examined  the  steps  the  University  of  Lethbridge  (University)  took  to  assess 
potential  risks  and  benefits  of  creating  Alberta  Terrestrial  Imaging  Center 
(ATIC).  a  not-for-profit  company  to  research  strategic  priorities  for  the 
University.  ATIC  is  owned  by  the  University  and  functus  Geomatics  Corp. 
(Iunctus),  a  private  company.  We  also  examined  the  ongoing  oversight  of  ATIC 
and  the  University's  business  relationship  with  Iunctus. 

Why  is  this  important  to  Albertans 

This  was  the  first  private  company  jointly  owned  by  the  University  and  an 
independent  third  party.  The  University  needs  to  properly  assess  potential  risks 
associated  with  its  decision  to  enter  into  these  types  of  relationships,  and 
maintain  oversight  and  monitoring  to  ensure  it  meets  the  objectives. 
Relationships  such  as  ATIC  can  be  beneficial  to  the  University:  helping  it  meet 
its  long-term  strategies  and  aligning  to  the  Alberta  government  priorities. 

What  we  found 

The  University's  system  to  perform  effective  assessment  of  risks  and  benefits 
on  potential  business  relationships  and  ongoing  monitoring  of  existing 
relationships  needs  improvement.  Specifically,  we  found: 

•  management  should  have  provided  more  complete  information  to  the 
Board  of  Governors  (Board)  on  the  recommendation  to  pursue  the  business 
relationship.  The  information  provided  was  incomplete  and  management 
did  not  assess  the  reasonability  of  the  information. 

•  the  University  could  improve  its  monitoring  process  to  determine  if  ATIC 
continues  to  meet  the  University's  objectives.  The  University  does  not  have 
well-defined  measures  to  assess  if  ATIC  is  meeting  the  University's 
objectives. 
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What  needs  to  be  done 

The  University  needs  to  develop  stronger  processes  in  considering  courses  of 
action  and  monitoring  ongoing  activities  when  dealing  with  business  partners. 
As  well,  the  University  needs  to  assess  and  document  its  ongoing  risks  with  its 
business  relationship  with  ATIC. 

2.  Audit  objective  and  scope 

Our  objective  was  to  determine  if  the  University  has  effective  systems  to 
evaluate  the  potential  risks  and  benefits  of  entering  a  business  relationship,  and 
systems  to  monitor  the  effectiveness  of  the  business  relationship.  We  did  not 
assess  the  viability  of  ATIC  or  the  potential  benefits  the  University  may  receive 
from  it. 

We  examined  documents  relating  to  the  business  relationship  between  the 
University,  ATIC,  and  Iunctus.  We  also  interviewed  University  employees,  as 
well  as  current  and  past  members  of  the  Board  of  Governors. 

3.  Background 

Iunctus  is  a  private  company  formed  by  former  University  graduate  students.  It 
produces  and  distributes  geo-spatial  information  products.  Iunctus  has  the 
Canadian  property  rights  to  the  SPOT  (Satellite  Pour  L'observations 
De  La  Terre)  Satellite  Imagery  and  is  the  archive  of  those  images.  Pursuant  to 
an  agreement  between  Iunctus  and  the  University,  Iunctus  will  provide  satellite 
imagery  to  the  University  through  ATIC  for  academic  and  non-commercial 
purposes.  Iunctus  will  continue  to  sell  the  images  for  commercial  purposes. 

The  University's  President  declared  a  financial  conflict  of  interest  relating  to 
this  business  relationship.  Due  to  the  President's  conflict,  the  Board  directed  the 
Vice  President  Finance  and  Administration  (VP  Finance)  to  administer  the 
interaction  between  the  University  and  ATIC. 

On  June  21,  2005,  the  University  and  Iunctus  incorporated  ATIC.  The  two 
parties  agreed  to  establish  a  research  facility  on  the  University  campus  to  carry 
out  research  that  directly  supported  other  strategic  research  initiatives  of  the 
University  and  Iunctus.  The  University  also  wanted  to  promote  optical  remote 
sensing  as  a  strategic  area  of  research  excellence  and  to  attract  high  quality 
faculty  and  students. 


Iunctus' 

background  and 
contribution 


University 
President  declares 
conflict  of  interest 


ATIC  formed  to 
do  optical  remote 
sensing 


24  R^P^ll  °j Jne  Auditor  General  of  Alberta 


April  2009 


Advanced  Education  and  Technology 


University  of  Lethbridge — Research  Investment — 
Alberta  Terrestrial  Imaging  Corp  (ATIC) 


Board  of 
Governors 
oversees 
management 


The  Board  oversees  the  University's  administration.  A  key  element  of  board 
governance  is  that  it  is  separate  from  management  and  that  it  includes  the  idea 
of  challenge  to  ensure  that  decisions  made  are  prudent  and  are  in  the  best 
interest  of  the  University.1  The  Board  Finance  Committee  assists  the  Board  in 
fulfilling  its  responsibility  in  the  oversight  of  the  financial  plans,  policies  and 
practices  of  the  University. 


Recommendations 
submitted  by 
management  and 
approved  by  the 
Board  of 
Governors 


The  Board  passed  the  following  key  motions  dealing  with  the  University's 
relationship  with  Iunctus  and  ATIC: 

•  October  2004    authorized  management  to  proceed  with  a  10-year  ground 
lease  with  Iunctus  to  establish  a  ground  station  on  University  property.  The 
Lieutenant  Governor  approved  this  through  an  Order  in  Council". 

•  June  2005  authorized: 

o     Management  to  enter  into  a  Relationship  Agreement,  a  Unanimous 
Shareholder  Agreement,  and  a  Lease  Agreement  with  Iunctus  and 
ATIC. 

o     Management  to  advance  $350,000  to  ATIC  so  they  could  pay  for: 

■  $  1 00,000  for  transfer  and  storage  of  the  SPOT  archi\  e. 

■  $  1 50,000  for  compensation  costs  for  ATIC's  program  director. 

■  S 1 00,000  for  general  support  of  ATIC's  operations. 
Appointment  of  a  University  Board  member  on  ATIC's  Board  of 
Directors. 

Appointment  of  an  independent  member  on  ATIC's  Board. 
August  2005 — authorized  management  to: 
o     Incorporate  ATIC  into  a  not-for-profit  entit)  . 

o     Purchase  $500,000  of  additional  research  equipment  (using  funds  from 

an  Alberta  Innovation  and  Science  grant. ) 
o     Confirm  that  the  conditions  of  a  grant  w  ith  Alberta  lnno\  ation  and 
Science  were  satisfied. 


o 


o 


In  addition  to  the  expenses  approved  by  the  Board  in  June  2005  and 
August  2005,  the  University  had  paid  $864,000  of  ATIC  expenses  by 
March  2008.  This  figure  consists  of  $322,000  for  equipment  and  $542,000  for 
wages,  license  fees  and  other  operating  costs. 


'  University  of  Lethbridge    Charter  of Expectations  for  Board  of  Governors —  Section  3.4.2.  states — "  ensure  Senior 
Administrators  identify  the  principal  risks  to  the  University  and  ensure  appropriate  systems  are  in  place  to  manage  the  risks". 
2  O.C.  206/2005 
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4.  Our  findings  and  recommendations 

In  our  October  2008  Public  Report  (page  23 1 ),  we  made  the  following 
recommendation  to  the  University  of  Lethbridge: 

"We  recommend  that  University  of  Lethbridge  management  periodically 
report  to  the  Board  of  Governors  key  information  on  financial  risks  in 
research  management." 

We  subsequently  looked  into  the  relationship  between  the  University  and 
ATIC.  Specifically  we  looked  at: 

•  assessment  of  risks  and  benefits  of  establishing  the  relationship. 

•  monitoring  the  ongoing  relationship. 

As  a  result  of  our  subsequent  work,  we  have  extended  our  original 
recommendation  to  the  following: 

4.1  Improve  processes  for  investing  in  research  projects 
Recommendation  No.  1 

We  recommend  that  the  University  of  Lethbridge: 

•  strengthen  processes  for  assessing  risks  and  benefits  relating  to 
prospective  business  relationships. 

•  strengthen  processes  to  oversee  and  monitor  financial  and  other  risks 
throughout  the  life  of  business  relationships. 

•  periodically  report  to  the  Board  of  Governors  key  information  on 
financial  and  other  risks  in  research  management. 

We  also  include  information  relative  to  the  University  handling  of  the 
President's  declared  conflict  of  interest  in  Section  4. 1 .3. 

4.1 .1     Improve  processes  for  risk  assessment 
Background 

In  June  2005,  management  recommended  to  the  Board  Finance  Committee  that 
they  approve  and  recommend  to  the  Board  that  the  University  be  authorized  to: 

•  enter  into  a  Relationship  Agreement,  Unanimous  Shareholder  Agreement, 
and  a  Lease  Agreement  with  Iunctus  and  ATIC. 

•  advance  $350,000  to  ATIC  for  certain  costs. 

•  nominate  a  University  Board  member  to  ATIC's  Board  of  Directors. 

•  nominate  a  private  citizen  as  an  independent  member  on  ATIC's  Board  of 
Directors. 


Board  of 
Governors 
approved 
recommendation 
to  form  ATIC 
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Documents 
presented  to  the 
Board  of 
Governors 


To  assist  the  Board's  Finance  Committee  and  the  Board  in  making  these 
decisions,  management  presented  an  information  package  about  the  proposed 
business  venture.  This  package  included: 

a  covering  memo  outlining  the  rationale  for  the  recommendation,  including 
the  benefits  for  the  University . 

a  letter  from  the  University's  lawyer  discussing  the  relationship  between 
the  University  and  lunctus. 

an  Order  in  Council  approving  a  10-year  land  lease  agreement  w  ith 
lunctus. 

confirmation  of  Natural  Sciences  and  Engineering  Research  Council  of 
Canada  research  grant  to  provide  $200,000  in  support  of  ATIC. 
Returns  on  Investment  on  ATIC  as  prepared  by  the  VP  Research. 


Criteria:  the  standards  we  used  for  our  audit 

The  University  should  have  effective  processes  to  assess  risks  and  benefits 
w  hen  deciding  to  enter  into  business  relationships. 


Incomplete 
information  to  the 
Board 


Our  audit  findings 

The  process  that  management  and  the  Board  used  to  assess  the  potential 
financial  risk  of  the  business  relationship  with  lunctus  was  inadequate. 
Management  presented  incomplete  information  on  the  business  venture  to  the 
Board  Finance  Committee  and  the  Board.  Based  on  this  information,  the  Board 
passed  a  motion  authorizing  management  to  enter  into  the  arrangement  with 
lunctus  to  form  ATIC. 


Limited  financial 
information 
presented  to 
Board,  and 
reasonability  of 
information  not 
assessed 


In  our  review  of  the  information  package  and  from  interv  iews  we  conducted 
with  management  and  Board  members,  we  found  the  following: 

•  Management  and  the  Board  did  not  assess  lunctus"  financial  or  corporate 
condition  to  determine  any  potential  risks  with  this  company. 

•  A  summary  sheet  of  Returns  on  Investment  was  the  only  financial 
information  included  in  the  Board  information  package.  This  document 
indicated  that  initial  investments  by  Alberta  Innovation  and  Science,  and 
Western  Economic  Diversification  Canada  of  SI. 5  million  each  would 
leverage  additional  funds  from  other  agencies  of  $18.2  million  over  five 
years.  The  returns  listed  were  contributions  or  grants  that  would  potentially 
be  available  to  ATIC.  lunctus  was  listed  as  a  source  of  $4.25  million.  It  is 
unclear  from  the  documentation  provided  as  to  how  and  when  this 

$4.25  million  would  be  provided,  or  how  it  was  determined. 
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We  did  not  see  analysis  of  the  expected  cash  flows  from  ATIC.  Nor  did  we 
see  a  discussion  of  the  risks  associated  with  the  projected  revenue  sources, 
and  what  the  University's  role  would  be  in  funding  ATIC  should  projected 
revenues  not  materialize. 


No  business  case 
for  ATIC 


Board  oversight 
should  have  been 
greater 


Management  did  not  prepare  a  business  case  or  a  detailed  summary  of  a 
business  case  for  the  Board.  Management  prepared  an  ATIC  grant  proposal  for 
research  grant  applications  but  did  not  share  it  with  the  Board.  The  grant 
proposal  did  not  include  all  of  the  items  that  we  would  have  expected  in  a 
business  case.  In  our  view,  management  should  have  prepared  a  business  case 
for  ATIC  that  outlines  the  objectives,  the  various  options  management 
considered,  the  financial  information  for  each  option  and  the  University's  risks 
and  benefits  for  each  option.  With  the  business  case,  the  Board  then  could: 

•  decide  if  the  University  should  proceed  with  the  proposal. 

•  determine  the  maximum  amount  of  funds  the  University  was  prepared  to 
invest  into  the  proposal. 

•  create  a  process  to  annually  review  ATIC's  performance. 

•  discuss  and  approve  an  exit  strategy3  in  the  event  the  business  venture  fails. 

The  Board  did  not  provide  adequate  oversight  and  guidance  to  this  proposal. 
We  would  expect  that  the  Board's  oversight  in  this  decision  would  have  been 
enhanced  due  to: 

•  the  President's  conflict  of  interest  as  discussed  in  section  4. 1 .3, 

•  the  University  is  breaking  new  ground  in  establishing  a  private  business 
enterprise  with  an  independent  third  party,  and 

•  the  financial  risk  to  the  University  should  ATIC's  revenues  not  materialize, 
as  discussed  in  section  4. 1 .2. 

Implications  and  risks  if  recommendation  not  implemented 

Ineffective  assessment  and  monitoring  of  ongoing  business  relationships  expose 
the  University  to  increased  risk. 


28 


3  Exit  strategy  conditions  were  covered  in  the  Relationship  Agreement  and  Unanimous  Shareholder  Agreement. 
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I  \  pes  of 
information 
management 
reported  to  the 
Board  of 
Governors 


4.1 .2     Improving  oversight  and  monitoring 
Background 

Management  provided  updates  about  ATIC  to  the  Board  Finance  Committee 
and  the  Board.  These  updates  included: 

•  grants  the  University  or  ATIC  received  for  this  research  facility. 

•  problems  with  retaining  personnel  in  key  management  positions. 

•  inability  to  obtain  timely  ATIC  financial  information. 

•  budget  projections. 


In  the  June  6,  2005  submission  to  the  Board  Finance  Committee,  management 
asserted  the  follow  ing  reasons  for  pursuing  this  endeavour: 

•  it  w  ould  benefit  a  large  number  of  University's  departments. 

•  researchers  working  in  ATIC  would  have  access  to  the  state  of  the  art 
research  infrastructure. 

•  unique  training  opportunities  for  undergraduate  and  graduate  students. 

•  access  to  SPOT  imagery  for  academic  purposes. 

In  addition,  the  ATIC  grant  proposal  contained  a  set  of  goals,  objectives  and 
performance  measures.  Management  never  prepared  a  progress  report  on 
w  hether  these  were  being  met. 

Criteria:  the  standards  we  used  for  our  audit 

The  University  should  monitor  ATIC  ongoing  operations  to  ensure  it  continues 
to  meet  the  University's  objectives  and  resolve  any  risks  to  the  University. 


ATIC  in  operation 
three  years, 
experienced 
ehalleimes 


Our  audit  findings 

The  University's  ongoing  monitoring  of  potential  risks  related  to  ATIC  could 
be  strengthened.  The  University  has  been  associated  with  this  business  venture 
for  over  three  years.  As  a  start-up  company,  ATIC  encountered  a  number  of 
challenges.  We  found  ample  documentation  outlining  the  various  grants  that  the 
University  or  ATIC  received.  However,  we  found  little  documentation  or 
challenge  relating  to  ATIC's  actual  performance  compared  to  the  original 
business  proposal.  The  University  needs  to  consider  several  factors  such  as 
financial  risk,  opportunity  costs  and  reputational  risks  when  making  decisions. 
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Ongoing 
monitoring  of 
business 

relationship  weak 


It  is  not  clear  to  us  what  processes  management  or  the  Board  used  to  ensure  the 
ATIC  investment  remained  a  viable  concept.  We  saw  no  evidence  of  reviewing 
previous  budget  projections  or  seeing  if  the  benefits  the  University  expected 
through  this  arrangement  actually  occurred,  such  as  access  to  the  SPOT 
imagery.  There  was  no  reporting  on  the  performance  measures  as  outlined  in 
ATIC's  grant  proposal  application.  The  University  did  not  receive  timely 
financial  information  from  ATIC.  Thus,  it  was  difficult  for  the  University  to 
properly  monitor  its  investment  in  ATIC. 


As  of 

March  31,  2008, 
ATIC  owes  the 
University 
$864,000 


According  to  the  University's  financial  statements  as  of  March  31,  2008,  ATIC 
owes  the  University  $864,000.  This  indebtedness  arose  from  the  University 
paying  for  some  of  ATIC's  expenses  for  equipment,  licensing  fees  and 
employee  compensation.  The  VP  Finance  told  us  that  the  University  paid  these 
expenses  as  ATIC  was  experiencing  cash  flow  problems.  Given  the 
circumstances,  we  would  have  expected  the  Board  to  approve  the  University 
paying  for  ATIC  expenses  on  a  temporary  basis.  As  noted  earlier,  the  Board 
passed  a  motion  in  June  2005  authorizing  management  to  contribute  $350,000 
to  ATIC  using  $150,000  of  internally  allocated  funds  and  $200,000  from 
specific  grant  funding  obtained  for  ATIC.  However,  the  Board  did  not  pass  a 
motion  authorizing  management  to  pay  for  the  additional  expenses  in  excess  of 
$350,000. 


ATIC  to  repay 
funds  by  2011 


The  University  believes  ATIC  will  be  able  to  repay  the  $864,000  by 
March  31,  201 1.  This  is  partially  based  on  an  ATIC  four-year  pro  forma 
statement  that  was  provided  to  management  by  ATIC  in  March  2009.  To 
protect  its  investment,  the  University  entered  into  a  General  Security 
Agreement  and  a  Priority  Agreement  for  any  receivables  with  ATIC  in  the  fall 
of2008. 


University  needs 
to  develop  a 
strategy 


Management  advised  us  that  the  University  is  currently  only  paying  for  a 
University  employee  working  at  ATIC.  Grant  revenues  will  be  used  to  repay 
this  expense  until  March  2010.  However,  if  ATIC  cannot  secure  new 
government  grants  after  March  2010  or  increase  its  sales  revenue,  the 
University  may  be  called  upon  to  provide  additional  funding  for  ATIC's 
operations.  The  University  needs  to  develop  a  strategy  as  to  how  it  will  address 
ATIC's  future  if  it  cannot  meet  its  financial  obligations  as  they  become  due. 
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Need  to  protect 
I  [ni\  ersit\  's 
integrity  and 
reputation 


Implications  and  risks  if  recommendation  not  implemented 

The  University  of  Lethbridge  needs  to  ensure  decisions  made  by  management 
and  Board  protect  its  resources,  integrity  and  reputation.  Without  full 
information,  the  Board  cannot  properly  assess  if  risks  are  being  adequately 
managed. 


President  declares 
conflict 


Plan  put  in  place 
to  manage  the 
conflict 


4.1 .3     Conflict  of  interest  declared  by  the  President 

The  President  of  the  University  declared  a  financial  conflict  of  interest  to  the 

Board  Chair  in  2003  when  the  University  entered  into  preliminary  discussions 

with  functus.  The  following  plan  was  put  in  place  to  manage  the  ongoing 

conflict: 

•  The  President  excused  himself  from  all  involvement  regarding  the 
University's  relationship  with  ATIC  and  functus. 

•  The  VP  Finance  was  appointed  as  the  University's  representative  on  all 
matters  regarding  ATIC  and  functus. 


Additional 
reporting 
requirements 
needed 


The  Board  did  not  communicate  to  management  any  specific  approval  or 
reporting  requirements  regarding  ATIC.  In  our  view,  this  was  a  significant  gap 
in  the  process,  given  that: 

•  this  was  a  new  type  of  business  arrangement  for  the  University . 

•  the  President  was  unable  to  provide  guidance  because  of  his  conflict. 

•  the  President's  authority  was  delegated  to  a  position  of  lesser  authority. 

•  the  University  was  paying  ATIC's  expenses  on  an  interim  basis  due  to 
ATIC's  cash  flow  problems. 


Further  consideration  should  have  been  given  to  establishing  clear  approval  and 
reporting  requirements  with  revised  materiality  levels  to  reflect  the  additional 
risks  associated  with  this  unique  set  of  circumstances.  Not  only  would  this  have 
helped  demonstrate  proper  handling  of  the  conflict  of  interest,  it  would  have 
protected  management  from  allegations  of  w  rongdoing. 


Complaint  lodged 
against  the 
President 


In  December  2004,  a  faculty  member  lodged  a  complaint  against  the  President 
for  signing  a  research  grant  application  and  not  disclosing  his  conflict  of 
interest.  A  portion  of  the  research  grant  relating  to  this  application  w  as  going  to 
be  allocated  to  the  University's  involvement  w  ith  ATIC. 
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Complaint 
investigated 


Three 

recommendations 
made 


The  President  informed  the  Board  Chair  of  the  allegations  made  against  him. 
The  Board  formed  an  Investigative  Task  Force  (ITF)  composed  of  three  Board 
members  to  review  the  allegation.  The  faculty  member  withdrew  the  complaint 
before  the  ITF  completed  its  review,  however,  the  ITF  continued  with  their 
review  and  made  three  recommendations  which  the  University  implemented: 

•  review  the  protocol  for  institutional  grant  applications. 

•  review  the  conflict-of-interest  implementation  protocol. 

•  advise  the  Natural  Sciences  and  Engineering  Research  Council  of  Canada 
of  the  President's  conflict  of  interest. 


President  cleared 
of  wrongdoing 


The  ITF  cleared  the  President  of  any  wrongdoing.  We  reviewed  the  findings 
and  have  no  further  recommendations  to  those  made  by  the  Investigative  Task 
Force. 
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Drinking  Water — Follow-up 


Follow  up  on 
three 

recommendations 
from  2006  report 


Summary 

What  we  examined 

In  our  October  2005-2006'  Annual  Report,  we  made  six  recommendations 
about  the  Department  of  Environment's  systems  for  regulating  drinking  water 
in  Alberta.  In  2006  we  concluded  that  the  Department  had  necessary  systems  to 
fulfill  its  drinking  w  ater  mandate  and  our  recommendations  focused  on 
improving  the  design  of  some  of  these  systems.  This  year,  we  did  a  follow-up 
audit  to  assess  the  Department's  progress  in  implementing  three  out  of  these  six 
recommendations.  The  remaining  recommendations  require  a  longer 
implementation  timeframe  and  we  will  follow  them  up  later.  The 
recommendations  selected  for  this  follow-up  represent  areas  that  are  directly 
involved  in  managing  risks  associated  with  waterworks  operations.  In  this 
Report,  we  follow  up  our  2006  recommendations  that  the  Department  of 
Environment: 

•  make  its  approvals  and  registrations  system  more  effective. 

•  improve  its  drinking  w  ater  inspection  processes. 

•  work  w  ith  its  drinking  w  ater  partners  to  update  strategies  to  deal  w  ith 
Alberta's  needs  for  certified  w  ater  treatment  operators. 


The  remaining  recommendations  deal  with  support  acth  ities  and  information 
needs,  such  as  improving  and  updating  the  Department's  information  systems, 
enhancing  central  policy  support  and  partnerships,  as  well  as  impro\  ing 
regulatory  and  information  systems  around  water  well  drilling  activities. 


Drinking  water 
important  to 
health 


Why  it  is  important  to  Albertans 

We  did  the  original  audit  because  quality  of  drinking  water  is  important  to  the 
health  of  Albertans  and  people  w  ho  visit  this  province.  Systems  to  properly 
operate  and  monitor  potable"  w  ater  treatment  and  distribution  are  vital  to  the 
well-being  of  people. 


Annual  Report  of  the  Auditor  General  of  Alberta,  2005-2006  (vol.  1 ,  pages  37-61 ). 

"  Potable  w  ater  is  defined  by  Environmental  Protection  Enhancement  Act  as:  "w  ater  that  is  supplied  by  a  waterw  orks  system 
and  is  used  for  drinking,  cooking,  dish  washing  or  other  domestic  purposes  requiring  water  that  is  suitable  lor  human 
consumption." 
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Plan  developed  to 
implement  our 
2006 

recommendations 


Good  progress  but 
not  yet  fully 
implemented 


What  we  found 

The  Department  developed  a  plan  to  implement  our  2006  recommendations, 
and  assigned  responsibility  for  timelines  and  progress  reporting  for  each 
recommendation  we  made.  The  Department  is  now  better  positioned  to 
maintain  its  drinking  water  safety  performance. 

The  Department  has  made  good  progress,  but  not  yet  fully  implemented  our 
recommendations  for  improving  systems  for  approvals  and  registrations  and 
drinking  water  inspection  processes.  We  conclude  that  the  Department  has 
implemented  our  recommendation  on  certified  waterworks  operators. 


Department 
improved 
approvals  and 
inspections — but 
needs  to  do  more 


Significant  improvements  have  been  made  in  the  areas  of  approvals  and 
inspections.  We  highlight  a  number  of  good  practices  we  observed  during  our 
fieldwork.  However,  a  number  of  important  steps  remain  to  be  taken.  In  the 
approvals  area,  we  identified  increased  application  processing  times,  issues 
with  design  drawing  documentation  for  older  facilities  and  no  formal  system  to 
follow-up  on  short-term  approval  conditions.  In  the  inspections  area,  the 
Department's  initiative  to  assess  and  inspect  applicable  industrial  and  private 
waterworks  remains  to  be  completed. 


What  remains  to  be  done 
Approvals  and  registrations 

improve  timeliness  of  approval  actions  by  establishing  and  following 
guidelines  for  application  processing  times. 

clarify  design  documentation  requirements  for  original  engineering  plans 
and  design  drawings. 

establish  a  system  to  follow-up  on  short-term  approval  conditions. 
Inspections 

confirm  regulatory  requirements  for  industrial  and  private  facilities  with 
existing  waterworks. 

finalize  the  list  of  industrial  and  private  facilities  that  need  to  be  included  in 
the  municipal  drinking  water  inspection  program, 
inspect  industrial  and  private  facilities  that  have  waterworks  supplying 
potable  water. 
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2.  Audit  objectives  and  scope 

2.1  Our  audit  objective 

Our  objective  was  to  determine  if  the  Department  of  Environment  has 
implemented  three  of  our  numbered  recommendations  from  our  2005  2006 
Report: 

•  Approvals  and  registrations 

•  Inspection  systems 

•  Waterworks  operators 


2.2  Our  scope 
What  we  did  In  performing  the  audit,  we: 

visited  three  of  the  six  Environment  district  offices, 
interviewed  management  and  staff. 

accompanied  drinking  water  inspectors  on  four  facility  inspection  visits, 
examined  documentation  in  areas  related  to  all  three  recommendations, 
reviewed  22  inspection  and  20  approval  files  for  individual  facilities  to 
confirm  proper  documentation  and  timeliness. 


Municipalities 
provide  most 
drinking  water 


We  conducted  our  fieldwork  from  October  to  December  2008  and  focused  on 
the  Department's  actions  since  our  October  2006  Public  Report. 

3.  Background 

Potable  water  in  Alberta  is  mostly  provided  by  municipal  waterworks.  Some 
industrial  and  private  facilities  also  produce  potable  water  for  on-site 
consumption  and  supply  to  nearby  communities. 


Tu  o  sources  of 
w  ater 


Water  treatment  facilities  obtain  water  either  from  surface  water  bodies  or  from 
groundw  ater  aquifers.  An  increasing  number  of  communities  in  Alberta  do  not 
rely  on  local  water  treatment  facilities  and  obtain  drinking  water  through 
regional  distribution  pipelines. 


Risks  depend  on 
water  source 


Different  risks  are  associated  with  different  drinking  water  sources.  ( renerally, 
groundwater  is  less  likely  to  contain  bacteria,  viruses,  other  organic  and 
non-organic  matter  than  surface  water.  However,  groundw  ater  may  contain  high 
concentrations  of  naturally  occurring  elements  that  may  require  additional 
treatment  and  monitoring,  such  as  heavy  metals.  In  some  cases,  groundwater 
contains  elements  such  as  iron  and  manganese  that  do  not  create  direct  and 
immediate  health  risks,  but  affect  taste  and  odour. 
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Three  types  of 
waterworks 


Water  treatment  facilities  include: 

•  surface  water  treatment  facilities  that  draw  raw3  water  from  lakes  and 
rivers.  For  regulator  purposes,  this  includes  operations  that  rely  on 
groundwater  sources  that  do  not  meet  the  criteria  for  high  quality 
groundwater  . 

•  high  quality  groundwater  treatment  facilities  that  rely  on  groundwater 
meeting  established  criteria. 

•  water  distribution  systems  that  transport  potable  water  from  treatment 
facilities  to  consumers. 


At  the  time  of  our  audit  there  were  592  municipal  waterworks.  There  were  also 
67  industrial  and  private  facilities  with  Environmental  Protection  and 
Enhancement  Act  (EPEA)  waterworks  clauses  in  the  approval.  The  municipal 
waterworks  included: 

•  247  approvals  for  surface  water  and  low  quality  groundwater  treatment. 

•  1 80  registrations  for  high  quality  groundwater  treatment. 

•  1 65  registrations  for  distribution  systems. 

There  are  30  facilities  that  were  approved  and  registered,  but  are  still  required  to 
follow  approval  conditions  until  directed  to  follow  corresponding  codes  of 
practice.  These  are  included  in  the  numbers  above. 


Approvals  for 
facilities  that  rely 
on  surface  water 
and  low  quality 
groundwater 


Surface  water  and  groundwater  facilities  sources  that  don't  meet  criteria  for 
high  quality  groundwater  are  issued  an  approval  under  EPEA  if  they  meet  the 
legislative  requirements.  Approvals  are  customized  to  each  waterworks  system 
and  contain  extensive  monitoring  and  reporting  requirements.  Approvals  expire 
after  1 0  years  and  can  be  renewed.  At  the  time  of  the  renewal,  waterworks 
operations  are  re-evaluated  and  renewed  approval  conditions  reflect  most 
current  standards  and  best  practices. 


3  Raw  water  is  drawn  from  the  environment  and  has  not  been  treated. 

4  High  quality  groundwater  is  defined  by  EPEA  Potable  Water  Regulation  as  the  groundwater  that: 

(i)  does  not  require  treatment  to  comply  with  the  applicable  physical,  chemical  and  radiological  Maximum  Acceptable 
Concentration  or  Interim  Maximum  Acceptable  Concentration,  except  for  fluoride,  specified  in  the  Guidelines  for 
Canadian  Drinking  Water  Quality,  published  by  Health  Canada,  as  amended  or  replaced  from  time  to  time,  for  the 
parameters  listed  in  the  Standards  and  Guidelines  for  Municipal  Waterworks,  Wastewater  and  Storm  Drainage 
Systems,  published  by  the  Department,  as  amended  or  replaced  from  time  to  time, 

(ii)  contains  a  concentration  of  naturally  occurring  fluoride  of  less  than  or  equal  to  2.4  milligrams  per  litre,  and 

(iii)  is  not  under  the  direct  influence  of  surface  water; 
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Registration  for  High  qualitv  groundwater  treatment  facilities  and  distribution  systems  are 

high  quality  issued  registrations  under  the  EPEA  if  they  meet  the  legislativ  e  requirements, 

groundwater  rT  .     .  .     ,  •  ■• 

facilities  and  Unlike  approvals  that  are  customized  to  each  facility,  registrations  direct 

distribution  facilities  to  follow  the  Code  of  Practice  for  Waterworks  System  using  High 

systems  Quality  Groundwater  (2003)  or  the  Code  of  Practice  for  Waterworks  System 

Consisting  Solely  of  a  Water  Distribution  System  (2008).  respectively. 

Registrations  don't  expire  and  registered  waterworks  would  be  required  to 

adjust  their  operations  in  accordance  with  future  updates  to  their  respective 

code  of  practice. 

Inspection  The  Department  has  set  specific  inspection  frequency  targets  for  all  w  aterw  orks 

frequency  targets  regulated  by  the  EPEA.  All  water  treatment  facilities  that  rely  on  surface  and 

arc  based  on  risk  .  ..  ,  .  ,  M     ,,T  . 

low  quality  groundwater  must  be  inspected  annually.  Water  treatment  systems 
that  rely  on  high  quality  groundw  ater  and  water  distribution  systems  must  be 
inspected  every  two  years.  A  report  must  be  generated  w  ithin  30  days  after  each 
inspection  and  provided  to  the  facility  owner  and  operator.  These  reports  outline 
contrav  entions  discovered  and  the  required  correctiv  e  action.  If  contrav  entions 
were  found,  an  operator  must  respond  within  30  days  on  the  corrective  action 
taken  or  planned. 

The  Department  Availability  of  qualified  operators  is  critical  for  safe  and  effective  operation  of 

regulates  and  an  waterworks  systems.  Even  in  cases  where  waterworks  infrastructure  is  of 

waterworks  older  design  and  construction,  a  know  ledgeable  operator  should  be  able  to  make 

operators  it  perform  at  a  level  that  meets  current  water  treatment  standards.  Regulation  of 

w  aterworks  operators  is  the  responsibility  of  the  Department  of  Environment. 
Jointly  w  ith  Alberta  Water  and  Wastewater  Operators  Association  (AWWOA)\ 
the  Department  ensures  the  development  and  delivery  of  professional  training 
programs,  as  well  as  development  and  administration  of  appropriate 
professional  examinations.  The  Department  issues  certifications  to  qualified 
waterworks  operators,  ensures  that  ongoing  certification  requirements  are  met 
and  maintains  the  waterworks  operator  database  for  the  province. 


5 


AWWOA  is  an  industry  association  w  ith  a  mission  to  contribute  to  the  training  of  its  members  and  persons  employed  in  the 
water  and  wastewater  field.  Refer  to  www.awwoa.ab.ca. 
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Our  2006 
recommendation 


4.  Conclusions 

4.1  Improving  Approval  and  Registration  systems — satisfactory  progress 
Background 

In  our  2005-2006  Annual  Report  (No.  1 — vol.  1,  page  37),  we  recommended 
that  the  Department  improve  its  approval  and  registrations  systems  by: 

•  strengthening  supporting  processes  such  as  training,  manuals,  checklists, 
and  quality  control  for  approvals  and  registrations, 

•  ensuring  that  applications  are  complete  and  legislatively  compliant, 

•  documenting  important  decisions  in  the  application  and  registration 
processes, 

•  processing  applications  and  conversions  promptly, 

•  maintaining  consistency  in  the  wording  of  approvals  and  registrations 
across  the  province,  and 

•  following  up  short-term  conditions  in  approvals. 


Created  two 
positions  in  policy 
and  training 


Updated  forms 
and  manuals 


Reinstated  annual 

approvals 

workshop 


Our  audit  findings 

Training  and  professional  support 

We  found  the  Department  took  the  following  positive  steps  in  implementing  our 
recommendation.  The  Department: 

•  created  the  Policy  and  Procedures  Coordinator  position,  as  well  as  the 
Policy  and  Training  Coordinator  position  to  address  gaps  in  training  and 
professional  supports  in  approval  and  compliance  areas.  These  positions 
are  instrumental  in  implementing  training  and  professional  support 
initiatives. 

•  updated  the  approval  template  and  manual,  and  the  approval  resume  form 
to  reflect  the  most  recent  standards  and  guidelines.  The  new  templates  were 
used  in  all  Alberta  Environment  offices  we  visited. 

•  reinstituted  the  Municipal  Approvals  Workshop  and  has  held  it  annually, 
starting  in  2006.  The  workshop  promotes  further  professional  development, 
communication,  learning  and  knowledge  sharing.  The  2008  workshop 
agenda  covered  such  areas  as  recent  industry  developments  in  water 
treatment  and  disinfection  technology,  updates  and  discussion  around 
regulatory  practices  and  policies,  as  well  as  provided  an  open  forum  where 
approvals  staff  from  all  regions  could  share  views  and  address  their 
concerns  with  management. 
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Set  up  resource 
website  for  staff 


De\  eloped 
training  plans 


launched  the  new  web-based  professional  resource  accessible  to  botli 
approvals  and  compliance  staff.  Drinking  w  ater  is  one  of  the  areas 
represented  on  this  new  intranet  portal,  which  serves  as  the  central 
electronic  one-stop  information  resource  for  key  document  templates, 
process  manuals  and  policy  guides,  applicable  legislation,  standards  and 
codes,  professional  development  and  training  information,  etc. 
developed  plans  to  formalize  training  and  professional  development 
process.  These  w  ill  include  introducing  formal  training  courses  as  well  as 
new  and  updated  orientation  training  programs. 


\\  e  conclude  that  the  Department  has  implemented  this  part  of  our 
recommendation. 


We  reviewed  all 
20  approval 
actions  from  2008 


Completeness,  timeliness  and  documentation  of  approval  actions 

We  reviewed  all  20  approval  actions  that  were  completed  in  2008  at  the  three 
district  offices  we  visited.  These  actions  included  four  initial  approv  als  and 
registrations,  1 1  approval  renewals,  four  amendments,  and  one  conversion  from 
the  approval  to  registration  under  distribution  system  Code  of  Practice 
registration. 


Increased  average 
approval  times:  12 
weeks  in  2008 
from  seven  weeks 
in  2006 


We  assessed  the  time  interval  from  when  the  Department  received  applications 
for  an  approval  action  to  when  applications  were  deemed  administrativ  ely 
complete,  and  to  when  approvals  and  registrations  were  formally  issued.  On 
average,  it  took  approximately  12  weeks  for  applications  to  be  deemed 
administratively  complete,  and  an  additional  18  weeks  for  approv  als  to  be 
issued.  Five  renewal  and  amendment  applications  took  over  one  year,  with  one 
amendment  application  taking  as  much  as  80  weeks  to  achieve  the 
administratively  complete  status.  For  these  five  facilities  we  found  no  evidence 
of  performance  issues  during  the  application  delay.  These  numbers  constitute  a 
substantial  increase  from  our  2006  findings.  \\  here  the  average  time  at  the  same 
district  offices  was  approximately  seven  weeks,  and  the  longest  time  to  reach 
administratively  complete  status  was  40  weeks.  While  legislation  and 
regulations  do  not  set  time  limitations  for  approval  actions,  the  Department 
doesn't  hav  e  consistent  guidelines  to  ensure  that  approval  applications  arc 
processed  within  a  reasonable  period  of  time. 


Inconsistent  filing 
and  unclear 
approval  clauses 
for  design 
documentation 


Engineering  design  documentation  is  useful  in  a  number  of  w  ays.  For  initial 
approvals,  the  original  design  documentation  allows  confirmation  of  proper 
construction.  The  original  design  documentation  is  typically  not  required  for 
application  renewals,  but  may  at  some  point  be  required  for  upgrades, 
expansions,  engineering  assessments,  emergency  situations,  decommissioning, 
etc.  We  found  that  new  facility  applications  and  upgrade  application  files 
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contained  relevant  engineering  design  documentation.  However,  for  older 
facilities  there  were  inconsistencies  in  documentation  of  original  plans  and 
design  drawings.  Current  standard  approval  clauses  are  not  clear  about  what 
sets  of  design  drawings  must  be  retained  by  approval  holders,  however  the 
regulations  are  specific  in  this  regard. 

We  conclude  that  the  Department  has  not  fully  implemented  this  part  of  our 
recommendation,  specifically  with  respect  to  the  timeliness  of  approval  actions 
and  design  documentation  requirements  for  the  existing  waterworks. 


No  system  to 
follow  up  on 
short-term 
approval 
conditions 


Short-term  conditions  follow  up 

The  Department  relies  on  individual  approval  writers  to  track  these  short-term 
conditions6,  but  our  interviews  with  management  and  staff  revealed  that  there  is 
no  clear  consistent  system  to  perform  this  function.  The  unmet  conditions  may 
be  identified  as  contraventions  by  the  inspection  process.  There  is  no  other 
mechanism  to  ensure  conditions  are  tracked  and  are  met  on  time.  We  conclude 
that  the  Department  does  not  yet  have  a  system  to  follow  up  on  short-term 
conditions  that  may  be  outlined  in  approvals. 


What  remains  to 
be  done 


To  fully  implement  this  recommendation  the  Department  should: 

•  improve  timeliness  of  approval  actions  by  establishing  and  following 
guidelines  for  application  processing  times. 

•  clarify  standard  documentation  requirements  to  ensure  they  are  consistent 
with  the  regulations,  specifically  with  respect  to  the  original  engineering 
plans  and  design  drawings. 

•  establish  a  system  to  follow-up  on  short-term  approval  conditions.  We 
expect  the  system  to  systematically  track  outstanding  conditions  on  the 
district  level  or  higher,  initiate  proactive  action  on  outstanding  conditions, 
and  provide  management  with  efficient  reporting  on  the  progress. 


Implications  and  risks  if  recommendation  not  implemented 

Without  strong  systems  to  support  approval  and  registration  writing,  the 
Department  may  not  be  able  to  ensure  that  waterworks  across  the  province  meet 
minimum  acceptable  drinking  water  standards. 


6  Short-term  conditions  are  issued  with  approved  renewals  and  relate  to  matters  expected  to  be  rectified  in  a  short  period  of 
time,  such  as  an  engineering  assessment  for  a  proposed  facility  upgrade. 
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Our  2006 
recommendation 


4.2  Improving  inspection  systems — satisfactory  progress 
Background 

In  our  2005-2006  Annual  Report  (No.  2    vol.  I .  page  43 ).  w  e  recommended 
that  the  Department  of  Environment  improve  its  drinking  water  inspection 
processes  h\ : 

•  applying  the  same  inspection  frequency  targets  to  all  waterworks  regulated 
by  the  Environmental  Protection  and  Enhancement  Act, 

•  ensuring  inspectors  receive  sufficient  training  in  waterworks  systems  and 
operations. 

•  revising  documentation  tools  and  practices,  including  making  them  more 
risk  focused,  and 

•  informing  operators  promptly  of  inspection  results,  ensuring  operators 
respond  appropriately  and  conclude  on  each  inspection. 


67  industrial  and 

private 

waterworks 


Some  facilities  not 
included  in 
drinking  water 
inspection 
program 


Our  audit  findings 

Inspection  frequency  targets  for  all  EPEA  waterworks 

There  are  presently  67  industrial  and  private  regulated  waterworks.  This 
represents  approximately  10%  of  all  regulated  waterworks  in  Alberta.  In  2006, 
we  found  that  industrial  and  private  waterworks  that  supply  potable  water  for 
on-site  or  public  use  were  not  included  in  the  municipal  drinking  water 
inspection  program.  Unlike  municipal  waterworks,  industrial  and  private 
facility  approvals  are  not  specific  to  drinking  water  and  cover  a  very  broad 
range  of  issues  ranging  from  air  emissions  to  soil  protection.  If  there  are 
waterworks  on-site  supplying  potable  water,  the  facility  approval  would  contain 
separate  clauses  making  these  waterworks  subject  to  applicable  regulations.  In 
2006  such  w  aterworks  were  only  inspected  once  every  10  years  as  part  of  an 
industrial  inspection  program  with  relatively  limited  attention  to  drinking  water. 


Industrial  and 
private 

w  aterw  orks  to  be 
in  municipal 
inspection 
program 


The  Department  is  implementing  an  initiative  to  include  applicable  industrial 
and  private  waterworks  in  the  municipal  drinking  water  inspection  program. 
Surface  water  treatment  facilities  need  to  be  inspected  annually.  Drinking  w  ater 
distribution  systems  need  to  be  inspected  once  every  two  years.  The  initiative 
includes  the  assessment  of  non-municipal  w  aterw  orks,  and  the  establishment  of 
the  process  to  include  appropriate  waterw  orks  in  the  municipal  drinking  water 
inspection  program.  The  final  outcome  of  the  initiative  w  ill  be  a  list  of 
industrial  and  private  waterworks  that  must  be  inspected  using  appropriate 
drinking  water  inspection  tools  and  at  appropriate  frequency.  While  the 
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Site  visits  to 
confirm  facility 
assessments 
remain  to  be  done 

Inspections  started 
but  not 

province-wide 


Department  has  made  progress  on  this  initiative,  it  is  not  yet  complete.  We 
observed  the  following: 

•  the  file  review  portion  of  the  industrial  facility  assessment  has  been 
completed,  but  Environment's  staff  have  not  conducted  site  visits  to 
confirm  what  waterworks  exist  and  whether  they  supply  potable  water. 
Review  of  and  conclusions  on  the  assessment  results  need  to  be  done. 

•  although  final  conclusions  and  decisions  on  the  assessment  are  still  to  be 
made,  most  district  offices  we  visited  have  started  to  regularly  inspect 
known  industrial  and  private  waterworks  using  drinking  water  inspection 
process  and  tools.  However,  this  is  not  done  across  the  province. 


We  conclude  that  the  Department  has  not  yet  fully  implemented  this  part  of  our 
2006  inspection  systems  recommendation,  as  it  has  not  yet  completed  the 
assessment  process  for  applicable  industrial  and  private  waterworks. 


Mentorship 
system  for 
inspectors  in  place 


Training  and  professional  support 

A  formal  mentorship  system  for  municipal  waterworks  inspectors  has  been 
established  and  implemented.  Each  inspector  is  assigned  a  senior  experienced 
colleague  who  acts  as  a  mentor.  Mentors  ensure  that  their  trainees  complete  the 
coursework  and  obtain  the  training  to  work  on  progressively  complex  types  of 
facilities.  The  process  is  recorded  and  maintained  on  each  inspector's  file.  This 
system  ensures  that  inspectors  receive  appropriate  training  and  are  only 
assigned  to  inspections  where  their  experience  is  matched  to  the  facility 
complexity  level.  Management  informed  us  it  may  expand  this  system  to  other 
inspection  areas. 


Training  program 
needs  more  time 
to  fully  develop 


The  Policy  and  Training  Coordinator  position  is  responsible  for  developing 
training  programs  or  courses.  While  the  development  of  one  water-sampling 
course  is  in  the  planning  stages,  the  development  of  the  overall  training 
program  is  not  completed.  This  is  an  ambitious  undertaking  that  will  take  time 
for  the  Department  to  complete.  Nevertheless,  we  conclude  that  the  Department 
has  implemented  this  part  of  our  2006  inspection  systems  recommendation. 


Made  inspections 
more  risk-based 


Risk  based  tools  and  practices 

To  implement  this  part  of  our  recommendation,  the  Department: 
•     developed  the  Risk  Based  Inspection  form  and  process  (RBI).  The  RBI 
indentifies  contraventions  by  primary  and  secondary  risk  areas,  focuses 
inspection  process  based  on  risk  and  results  in  a  clear  pass  or  fail 
conclusion. 
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Standardizing 
process  to  deal 
with 

non-compliance 


Piloted  new 
softw  are  and 
hardw  are 


Improved  process 
to  document 
inspections 


is  developing  the  Municipal  Potable  Water  Routing  C  hart  and 
Non-Compliance  Matrix.  Although  the  routing  chart  has  not  been  finalized, 
the  non-compliance  matrix  is  in  use  by  individual  inspectors.  The  Matrix 
provides  criteria  for  assessing  the  risk  level  and  significance  of 
non-compliances.  It  outlines  the  appropriate  compliance  or  enforcement 
action,  and  ensures  that  contraventions  are  dealt  with  consistently  across 
the  province. 

as  part  of  the  RBI  initiative,  piloted  new  inspection  software  and  hardware. 
This  inspection  system  promotes  efficiency,  improves  documentation  and 
avoids  process  duplication  through  direct,  on-site  electronic  entry  of  the 
inspection  results.  This  is  an  important  step  tow  ard  electronically  linking 
data  and  inspection  results  to  the  Department's  central  information 
management  system.  The  piloted  process  also  ensures  an  immediate 
electronic  sign-off  by  facility  operators  on  the  inspection  results  and 
corrective  actions  required. 

improved  processes  in  documenting  inspections.  Although  not  consistent 
across  all  files,  there  was  an  improved  use  of  inspection  diary  notes  and 
better  documentation  of  follow-up  and  communication  with  other  internal 
and  external  stakeholders. 


We  conclude  that  the  Department  has  implemented  this  part  of  our  2006 
inspection  systems  recommendation. 

Timeliness  of  inspection  reports  and  operator  responses 

We  sampled  22  waterworks  inspection  files.  All  completed  inspections  we 
re\  iewed  were  documented  in  main  facility  files  and  in  the  Department's 
central  electronic  information  management  system.  For  inspections  completed 
since  January  2008,  the  required  operator  responses  w  ere  either  received  on 
time  or  received  without  substantial  delays.  After  comparing  our  present 
findings  for  these  district  offices  with  those  from  our  2006  audit,  we  conclude 
that  the  Department  has  implemented  this  part  of  the  recommendation. 


What  remains  to 
be  done 


To  fully  implement  our  2006  inspection  systems  recommendation  the 
Department  should: 

•     confirm  regulatory  requirements  for  existing  industrial  and  private 
waterworks.  The  Department  has  identified  a  number  of  industrial  and 
private  approvals  with  existing  drinking  water  clauses  that  may  not  meet 
the  potable  water  definition  and  w  ould  not  need  to  be  included  in  the 
drinking  water  inspection  program.  We  expect  the  Department  to  visit  all 
such  facilities  to  confirm  their  operation,  and  consider  amending  their 
approvals  to  reflect  the  current  regulatory  requirements. 
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•  finalize  the  review  of  all  applicable  industrial  and  private  waterworks,  and 
clearly  determine  what  waterworks  meet  the  potable  water  definition  and 
must  be  included  in  the  drinking  water  inspection  program. 

•  inspect  appropriate  industrial  and  private  facilities  that  have  waterworks 
supplying  potable  water. 

Implications  and  risks  if  recommendation  not  implemented 

Without  confirming  regulatory  requirements  and  routinely  inspecting 
waterworks  facilities,  the  Department  will  not  know  whether  facilities  comply 
with  Alberta's  drinking  water  legislation  and  regulations,  and  therefore  supply 
water  that  is  safe  for  people  to  drink. 


2006 

recommendation 


4.3  Certified  Waterworks  Operators — implemented 
Background 

In  our  2005-2006  Annual  Report  (No.  3 — vol.  1,  page  49),  we  recommended 
that  the  Department  of  Environment,  working  with  its  drinking  water  partners, 
update  its  strategies  to  deal  with  the  province's  needs  for  certified  water 
treatment  operators.  Availability  of  qualified  waterworks  operators  in  the 
province  was  one  of  the  concerns  raised  in  our  2006  audit  report.  Rural  areas 
were  particularly  prone  to  shortages  of  qualified  operators. 


2008  pilot 
program  for 
short-term 
operator  support 


Decision  on 
program  due  in 
early  2009 


Our  audit  findings 

Operational  Assistance  Pilot  Program 

The  Department  launched  the  pilot  program  in  the  spring  of  2008.  The  program 
provides  a  short-term  solution  for  municipalities  that  face  sudden  and 
unanticipated  shortage  of  qualified  operators.  Under  this  program  the 
Department  provides  a  temporary  waterworks  operator  to  a  facility  for  up  to 
two  weeks,  after  which  the  facility  is  expected  to  find  a  permanent  replacement. 
The  Department  assumes  the  cost  of  providing  this  temporary  operator 
assistance  through  contracts  with  three  private  service  providers  that  ensure 
province-wide  program  coverage.  From  the  spring  of  2008  to  January  2009,  the 
Department  processed  32  applications  for  emergency  operator  assistance.  The 
pilot  program  will  end  in  early  2009,  when  a  decision  will  be  made  about 
whether  and  how  the  program  may  continue. 


Department 
promotes  sharing 
of  operators 
between 
municipalities 


Operator  Consortium 

The  Department  encouraged  and  supported  municipalities  in  finding  ways  to 
share  and  efficiently  utilize  their  operator  resources.  A  promising  model  the 
Department  has  identified  is  where  neighbouring  municipalities  enter  into 
agreements  to  share  their  operator  resources.  While  the  Department  is  not  a 
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parts  to  these  agreements,  it  encourages  dialogue  and  pros  ides  information  and 
technical  support  to  interested  municipalities.  Presently,  there  are  three  potentia 
operator  consortia  under  development. 


Department 
promotes  regional 
water  supply 


Regionalization 

The  Department  continues  to  promote  the  regionalization  of  water  supply  in  the 
province,  with  small  stand-alone  water  treatment  facilities  replaced  by  pipelines 
from  large  facilities  in  that  region.  One  of  the  benefits  of  regionalization  is  that 
it  helps  alleviate  some  of  the  pressure  on  operator  resources  in  rural  areas. 


More  operators 
now 


Updated  training 
and  exam 
materials 


Operator 

newsletter 

restarted 


Operator  Certification,  Training  and  Professional  Support 

•  The  number  of  certified  ss  ater  and  wastewater  operators  in  the  province  has 
increased  from  1,837  in  November  2006  to  2,098  in  January  2009.  As 
many  as  200  operators  are  expected  to  complete  mandator)  entrs  le\  el 
training  by  June  2009.  The  NA1T  Water  and  Wastew  ater  Technical 
Program  was  expanded  from  20  positions  in  2006  to  28  positions  in  2008. 

•  The  Department,  working  w  ith  the  Alberta  W  ater  and  Wastewater 
Operators  Association  (AW/WOA)  and  w  ith  input  from  operators  and  other 
professionals,  reviesved  and  updated  examination  materials  for  the  operator 
Levels  I  and  II  and  is  in  the  process  of  updating  materials  for  Levels  III  and 
IV.  This  ensures  that  examination  and  training  materials  reflect  the  most 
recent  standards  and  codes  of  practice. 

In  partnership  w  ith  AWWOA,  the  Department  has  also  reintroduced  the 
operators*  newsletter.  The  newsletter  is  an  important  mechanism  to  maintain 
communication  and  inform  operators  of  any  important  regulatory  changes  or 
technological  developments. 


Operator 
attendance 
guidelines 
introduced 


Minimum  Operator  Attendance  Guidelines 

In  January  2009  the  Department  introduced  Minimum  Certified  Operator 
Attendance  Guidelines  for  Waterworks  Systems  .  Based  on  facility  level  and 
remote  monitoring  capability,  the  guidelines  outline  minimum  operator  visit 
frequency,  maximum  acceptable  operator  response  time  and  other  factors  that 
relate  to  adequate  supervision  of  waterworks.  Although  these  arc  guidelines  and 
not  requirements,  this  is  a  very  important  step  forward  in  dealing  with  situations 
where  operators  manage  more  than  one  facility  or  perform  additional  non-water 
related  tasks. 


http://www.environment.alberta.ca documents  Minimum  Certification  Operator  Attendance  Guidelines_for_Waterworks_ 
Systems.pdf 
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Emergency  preparedness — 
Follow-up 

Emergency  preparedness — changed  circumstances 
Background 

In  2002  we  conducted  a  review  of  systems  at  the  Ministry  of  Municipal  Affairs 
(Ministry)  to  manage  the  risks  arising  from  its  responsibility  to  oversee  and 
coordinate  emergency  preparedness  across  the  province.  In  our  2001  2002  Annual 
Report  (No.  46 — page  220),  we  put  forward  a  two-part  recommendation.  We 
recommended  that  the  Ministry: 

•  improve  its  procedures  to  promote  and  coordinate  emergency  preparedness 
plans  developed  by  Alberta  government  departments  and  ministries,  and 

•  reassess  the  present  and  future  suitability  of  the  existing  Emergency  Operation 
Center. 

In  our  2002  2003  Annua/  Report  (page  24S).  we  \'oum\  the  Ministry  implemented 
the  second  part  of  our  recommendation.  In  our  2003  2004  Annual  Report 
(page  269),  we  followed  up  with  the  Ministry  on  the  first  part  of  the 
recommendation.  We  found  the  Ministry  made  progress  however  still  had  not 
implemented  it. 

Our  findings 

This  year  we  met  with  Ministry  staff  to  follow  up  on  the  part  of  the  recommendation 
that  was  still  outstanding.  Management  advised  us  of  a  number  of  significant 
changes  that  have  occurred  since  our  2003-2004  follow  up.  These  changes  include 
the  creation  of  the  Alberta  Emergency  Management  Agency  (AEMA)  in  June  of 
2007  and  the  enactment  of  the  Government  Emergency  Management  Regulation  in 
January  2008.  AEMA  leads  the  co-ordination,  collaboration  and  co-operation  of  all 
organizations  involved  in  the  prevention,  preparedness  and  response  to  disasters  and 
emergencies  in  Alberta. 

AEMA  is  also  responsible  for  preparing  and  managing  an  overall  comprehensive 
emergency  plan  for  the  prov  ince  known  as  the  Alberta  Emergency  Plan.  This  plan 
calls  for  each  department  to  prepare  a  Business  Continuity  Plan,  a  Consequence 
Management  Plan  and  in  some  instances  hazard-specific  plans.  The  department 
plans  are  submitted  to  AEMA  for  review  and  coordination.  Management  told  us  that 
AEMA  conducts  a  minor  review  of  the  plans  every  year  and  a  major  rc\  iew  c\  cry 
two  years. 
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With  the  changes  that  have  occurred  within  the  Ministry  since  our  2002  audit,  we 
believe  our  outstanding  recommendation  is  no  longer  valid.  AEMA  is  in  its  infancy 
and  requires  time  to  fully  develop  its  processes  as  it  oversees  the  Alberta  Emergency 
Plan.  It  is  our  intention  at  some  future  time  to  audit  AEMA's  performance  to  ensure 
it  is  fulfilling  its  mandate  in  an  efficient  and  effective  manner. 
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Reforestation — Follow-up 

1.  Summary 

The  Department  of  Sustainable  Resource  Development  monitors  and  regulates 
several  key  components  of  forest  management  that  help  ensure  that  Alberta's 
forests  are  not  depleted.  These  components  include: 

•  harvest  planning  and  operations. 

•  balancing  wildlife,  industrial  and  recreational  demands  on  forests. 

•  fire  suppression  and  pest  control,  and 

•  reforestation. 

This  audit  focuses  on  the  last  component  listed — reforestation.  If  the 
Department  does  not  ensure  through  its  regulatory  systems  that  private  sector 
operators  sufficiently  reforest  cutblocks.  Alberta's  forests  are  in  danger  of 
depletion.  However,  each  of  the  other  components  includes  risks  that  could 
deplete  the  forests  despite  compliant  reforestation  efforts.  We  will  consider 
these  other  components  in  future  work. 


Follow-up  of  2006 
audit  on  systems 
to  regulate 
reforestation 


What  we  examined 

In  2006.  we  audited  systems  the  Department  of  Sustainable  Resource 
Development  used  to  regulate  reforestation.  This  year,  we  conducted  follow-up 
work  to  assess  if  the  Department  implemented  the  five  recommendations  in  our 
2005  2006  Annual  Report  (vol.  I,  page  109)  to: 

•  report  on  the  effectiveness  of  regulatory  acti\  ities. 

•  improve  controls  over  the  quality  of  performance  information. 

•  make  reforestation  monitoring  and  enforcement  more  rigorous  and 
effective, 

•  clarify  the  Forest  Resource  Improvement  Association  of  Alberta's 
(FRIAA)  accountability  through  a  memorandum  of  understanding,  and 

•  improve  controls  over  seed  management. 


Two  key  issues: 

•  Performance 
reporting 

•  Monitoring  and 
enforcement 


Our  original  audit  identified  two  key  issues.  First,  performance  reporting  was 
inadequate  to  assess  if  regulatory  requirements  and  the  underlying  processes  of 
both  the  Department  and  industry  were  resulting  in  successful  reforestation. 
Management  did  not  have  complete  and  accurate  data  available  to  support  the 
performance  measure  it  intended  to  report  annually.  Second,  the  Department's 
processes  to  monitor  industry  and  enforce  reforestation  requirements  were  not 
rigorous  enough. 
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Why  it  is  important  to  Albertans 

Forestry  is  the  third  largest  economic  sector  in  Alberta  after  petroleum  and 
agriculture.  The  forestry  industry  employs  about  50,000  people  in  Alberta  and 
accounts  for  several  billion  dollars  of  economic  activity.  Also,  Alberta's  forests 
are  environmentally  significant  in  cycling  carbon,  protecting  watersheds,  and 
providing  habitat  for  wildlife.  In  Alberta,  industry  has  been  delegated  the 
operational  responsibilities  to  ensure  that  harvested  forests  are  reforested  and 
managed  so  that  both  the  economy  and  environment  benefit  from  the  forests  in 
the  future.  Through  the  Department  of  Sustainable  Resource  Development,  the 
government  monitors  industry  to  ensure  they  fulfill  their  responsibilities  and 
obligations.  If  the  Department  does  not  adequately  monitor  industry,  Alberta's 
forests  may  not  be  adequately  maintained,  harming  both  the  environment  and 
future  economic  development. 

What  we  found  in  this  follow-up  audit 

The  Department  has  not  yet  implemented  a  process  to  report  on  the 
effectiveness  of  reforestation  activities.  The  Department  has  decided  not  to  use 
the  Reforestation  rate  in  harvested  areas  measure  that  we  reported  on  in  our 
original  audit.  It  had  continued  to  report  this  measure  was  in  development.  The 
Department  is  now  in  the  earliest  stages  of  developing  new  measures  for 
reforestation.  Therefore,  we  have  repeated  our  recommendation  originally  made 
in  2006. 

We  also  found  that  management  implemented  edit  checks  in  the  database  used 
to  collect  data  on  reforestation.  Therefore,  we  assessed  the  recommendation  on 
quality  of  performance  information  as  implemented. 

For  reforestation  monitoring  and  enforcement,  the  Department  is  implementing 
a  formal  quality  control  system  over  its  forest  management  operations.  The 
system  includes  standardized  protocols  for  Department  staff  to  follow  when 
they  monitor  industry's  compliance  with  reforestation  requirements.  Also,  this 
quality  control  system  will  include  an  ongoing  independent  review  and 
certification  using  ISO  9001  standards.  Independent  certification  of  the  quality 
control  system  is  a  best  practice.  We  believe  this  quality  control  system  will 
bring  the  necessary  rigour  to  make  monitoring  for  compliance  effective  when 
fully  implemented.  We  report  what  remains  to  be  done  in  section  4.2. 

Management  also  took  steps  to  assess  the  sufficiency  and  integrity  of  the 
provincial  seed  inventory.  We  report  what  remains  to  be  done  in  section  4.3. 


Still  no 

performance 

reporting 


Improved 
monitoring  and 
enforcement 
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I  he  Department  implemented  our  recommendation  to  clarih  accountability 
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with  the  fKlAA.  1  Ins  is  discussed  in  section  4.4. 

f 

What  remains  to  be  done 

Rele\ant 

The  Department  needs  to  identity  relevant  and  sufficient  performance  measures 

performance 
measures  and 
regular  reporting 
needed 

for  reforestation  and  formally  implement  an  ongoing  reporting  process.  The 
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sustainable  data. 

The  Department  took  significant  steps  towards  implementing  our 

recommendations  on  monitoring  and  enforcement,  and  seed  management.  Some 
steps  remain  before  we  can  consider  these  recommendations  fully  implemented. 

These  steps  are  enumerated  in  sections  4.2  and  4.3  respectively. 

2.  Audit  objective  and  scope 

2.1  Our  audit  objective 

Our  audit  objective  w  as  to  determine  if  the  Department  ot  Sustainable  Resource 

Development  had  implemented  five  recommendations  made  in  our  2005  2006 

innini/  Report  by: 

•     measuring  and  reporting  on  its  performance  as  the  regulator  of 

reforestation. 

•     improving  controls  to  collect  complete,  accurate  and  timely  reforestation 

information, 

•     strengthening  monitoring  and  compliance  processes  that  ensure  forestr) 

operators  fulfill  their  reforestation  obligations. 
•     clarifying  accountability  for  reforestation  with  the  f  orest  Resource 

Improvement  Association  of  Alberta,  and 

•     assessing  w  hether  there  is  an  adequate  supply  of  seeds,  and  controls  to 

ensure  seeds  arc  planted  in  the  correct  zone. 

z.z  uur  scope 

In  pertorming  the  audit,  we; 

What  we  did 

•     discussed  with  management,  and  assessed  the  actions  the\  took  regarding 

the  Department's  reforestation  performance  measure. 

* 

•     tested  it  Department  staff  were  following  the  new  processes  implemented 

to  improve  monitoring  and  compliance  ot  industry  reforestation  activities, 

•     reviewed  the  memorandum  of  understanding  the  Department  signed  w  ith 

FRIAA,  along  with  other  supporting  documentation,  and 

•     reviewed  reports  prepared  by  management  summarizing  plans  and  actions 

for  upgrading  seed  management. 

Report  of  the  Auditor  General  of  Alberta 

April  2009 

51 


Sustainable  Resource  Development 


Reforestation — Follow-up 


Timing  and  extent 
of  audit  work 


We  conducted  our  field  work  from  September  to  December  2008  and  focused 
on  the  Department's  actions  in  response  to  our  2005-2006  Annual  Report.  In 
addition  to  the  work  at  the  Department's  main  office,  we  visited  four  field 
offices,  as  well  as  the  Alberta  Tree  Improvement  and  Seed  Centre.  We 
interviewed  a  total  of  1 7  people  and  reviewed  1 8  forest  operator  files  in  the 
field  offices. 


Original  Report 

explained 

reforestation 


3.  Background 


Our  original  Report  in  2006  included  an  explanation  of  reforestation  in  Alberta. 
Readers  can  access  this  material  at  page  1 1 1  (Volume  1)  of  our  2005-2006 
Annual  Report.  The  background  explains: 
Provincial  authority  to  regulate  forests 
Sustainable  forests 
Harvesting  forests 
Forest  management  agreements 
Timber  quotas  and  permits 
Reforestation  standards 
Reforestation  from  start  to  finish 
How  the  Department  regulates  reforestation 
Risks  related  to  reforestation 


Still  no  reporting 
on  reforestation 


4.  Findings 

4.1  Performance  information — recommendation  repeated 

We  have  repeated  this  recommendation,  first  made  as  Key  Recommendation 
No.  13  in  our  2005-2006  Annual  Report  (vol.  1 ,  page  118),  because  the 
Department  still  does  not  report  adequately  on  the  effectiveness  of  reforestation 
activities.  The  recommendation  has  been  reworded  because  the  Department  no 
longer  plans  to  include  in  its  annual  report  the  performance  measure  referred  to 
in  our  2006  audit. 


Recommendation  No.  2 — repeated 

We  again  recommend  that  the  Department  of  Sustainable  Resource 
Development  publicly  report  relevant  and  sufficient  reforestation 
performance  information  to  confirm  the  effectiveness  of  its  regulatory 
systems. 
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Background 

In  2006  we  made  two  recommendations  to  the  Department  on  performance 
information  for  reforestation.  The  first  is  repeated  above.  The  second 
recommendation  in  our  2005  2006  Annual  Report  (No.  14    vol.  I.  page  IIS) 
had  tw  o  parts: 

•  strengthen  quality  control  processes  for  performance  information,  and 

•  re-examine  the  target  for  its  planned  performance  measure  reforestation 
rate  in  harvested  areas. 


Problems  \\  itfa 
performance 
information  and 
reports 


The  Department  w  as  unable  to  report  on  its  reforestation  rate  in  harvested 
areas  performance  measure  in  its  2006-2007  annual  report  because  it  decided 
that  more  work  was  required  to  ensure  the  data  entered  into  the  Alberta 
Regeneration  Information  System  (ARIS)  was  complete  and  accurate.  Our 
original  audit  also  found  that  quality  control  processes  for  performance 
information,  including  data  entered  into  ARIS  by  industry  ,  and  validation  of 
establishment  and  performance  surveys  performed  by  industry  ,  needed  to 
improve.  We  also  suggested  that  the  Department's  one  proposed  performance 
measure  did  not  provide  complete  information  on  reforestation  and  suggested 
supplementary  performance  indicators. 


Criteria:  the  standards  we  used  for  our  audit 

The  Department  should: 

•  measure  and  report  on  its  performance  as  the  regulator  of  reforestation,  and 

•  have  controls  to  collect  complete,  accurate  and  timely  reforestation 
information. 

Our  audit  findings 

Performance  reports 

During  our  2006  audit  the  Department  was  planning  to  include  in  its  annual 
report  the  reforestation  rate  in  harvested  areas  as  a  performance  measure  for 
the  reforestation  program.  When  we  performed  our  follow-up  audit  in  the  fall  of 
2008  management  indicated  that  they  had  decided  not  to  use  this  measure  in 
their  annual  report  because  the  measure  did  not  give  a  complete  picture  of  the 
state  of  Alberta's  forests. 


Still  no  suitable 

performance 

reporting 


We  are  repeating  our  recommendation  because,  as  the  timeline  below  shows, 
the  Department  has  planned  to  report  publicly  on  reforestation  for  almost 
five  years  but  it  still  has  not  done  so.  When  our  field  work  concluded  in 
December  2008,  the  Department  was  just  starting  work  on  possible 
performance  reports  for  the  public.  Internally,  the  Department  has  some 
performance  reports  but  is  still  developing  others. 
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Here  is  a  timeline  of  the  Department's  development  of  a  reforestation 
performance  measure: 

•  2004-2007  Ministry  Business  Plan  lists  "Reforestation'1  performance 
measure  as  "new"  and  "to  be  determined". 

•  2005-2008  Ministry  Business  Plan  does  not  include  reforestation 
performance  measure. 

•  2006-2009  Ministry  Business  Plan  lists  reforestation  rate  in  harvested 
areas  as  a  reforestation  performance  measure. 

•  2006-2007  Ministry  Annual  Report  did  not  report  on  the  measure  because 
the  Department  found  the  source  data  to  be  incomplete  and  inaccurate. 

•  2007-2010  Ministry  Business  Plan  indicates  additional  work  needed  to 
confirm  integrity  of  data.  Results  and  targets  will  not  be  published  until 
work  is  concluded. 

•  2007-2008  Ministry  Annual  Report  includes  a  sidebar  (pg.  58)  indicating 
the  Ministry  is  continuing  to  refine  management  reports  taken  from  ARIS. 

•  2008-201 1  Ministry  Business  Plan — no  reforestation  performance  measure 
included. 


Both  management 
and  public  need 
reports  on 
Department's 
performance 


Providing  the  public  with  a  broader  picture  of  the  state  of  Alberta's  forests  is 
useful.  However,  in  our  opinion,  both  management  and  the  public  should  also 
have  performance  information  to  determine  if  industry  is  complying  with 
reforestation  regulations  and  whether  the  Department's  reforestation  regulations 
and  programs  result  in  reforestation  to  targeted  levels.  Management  has  access 
to  data  about  reforestation  results,  but  we  could  not  see  evidence  that  this 
information  is  formally  reported  and  used  within  the  Department  to  assess 
whether  its  programs  are  achieving  targeted  outcomes.  For  example,  some  of 
the  data  we  were  shown  indicates  restocking  levels  within  Alberta  are  high 
overall  (greater  than  90%),  but  there  are  some  operators  and  forest  management 
areas  with  low  restocking  levels  (60%  range).  We  saw  no  evidence  that  these 
results  were  reported  to  and  reviewed  with  the  Department's  senior 
management.  We  also  found  that  compliance  issues  logged  in  a  Department 
database  are  not  compiled  and  reported  in  a  manner  to  meaningfully  analyze 
compliance-issue  trends  across  the  province. 


Performance 
information 
needed  to  confirm 
systems  work 


In  section  4.2  below  we  note  the  actions  management  has  taken  to  strengthen 
the  Department's  monitoring  and  enforcements  systems.  Anecdotally 
management  told  us  that  most  of  the  time  industry  is  complying  with 
reforestation  regulations  and  the  reforestation  standards  are  resulting  in  targeted 
reforestation  outcomes.  However,  without  relevant  and  sufficient  performance 
information,  management  cannot  objectively  assure  itself  or  Albertans  that  the 
Department's  monitoring  and  enforcement  systems  are  resulting  in  the 
anecdotal  outcomes. 
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While  the  Department  plans  to  develop  a  comprehensive  measure  of  "forest 
health",  it  has  not  yet  identified  or  formally  committed  to  a  new  measure. 
Management  was  in  only  the  earliest  of  stages  of  developing  a  new  measure  ami 
therefore  could  not  prov  ide  us  w  ith  specific  alternatives  they  were  considering 
when  we  concluded  our  field  work  in  December  200N.  During  the  audit,  we 
asked  whether  management  would  have  a  new  measure  ready  for  the 
2009-  2012  Ministry  Business  Plan  and  management  indicated  that  the  earliest  a 
measure  would  be  ready  is  the  2010-2013  Plan. 

Quality  control  process  for  performance  information 

The  Department  took  two  main  actions  to  improv  e  the  quality  of  performance 
information. 


J* 


ARIS  data 
validated 


One  action  was  to  implement  the  Forest  Operations  Monitoring  Program 
(FOMP)  which  includes  the  Silviculture/ARIS  Monitoring  process  (SAM).  This 
program  is  described  in  more  detail  in  the  monitoring  and  enforcement  section 
below.  SAM  audits  carried  out  by  the  Department  include  v  alidating 
establishment  and  performance  survey  results  entered  into  ARIS  b)  industry 
against  source  documentation.  Also,  when  a  FOMP  inspection  detects  any  error 
in  ARIS,  the  item  is  tracked  for  follow-up  to  ensure  that  industry  corrects  the 
error. 


0* 


Automated 
computer  controls 
implemented 


The  second  action  was  to  implement  automated  computer  controls  w  ithin  ARIS 
to  improve  the  completeness  and  accuracy  of  information  in  that  database.  For 
example,  once  key  data  has  been  entered  initially  by  industry,  adjustments 
cannot  be  processed  by  industry  unless  submitted  through  Department  staff. 
This  control  helps  ensure  that  data  entered  and  v  alidated  by  the  Department 
cannot  be  changed  later  vv  ithout  the  adjustment  also  being  validated.  ARIS  also 
now  has  many  automated  checks  that  test  submissions  from  industry  when 
initially  loaded  into  the  database.  These  automated  business  rules  lest  lor  errors 
such  as  missing  fields  or  values  exceeding  certain  thresholds  set  by  the 
Department.  We  used  computer  assisted  audit  techniques  to  confirm  that  these 
business  rules  were  implemented. 


Quality  control 
ov  er  performance 
data  implemented 


These  two  key  actions  mean  that  the  Department  has  implemented  the  part  of 
our  recommendation  in  the  2005  2006  Annual  Report  (No.  14— vol.  1. 
page  1  18)  dealing  w  ith  quality  control  for  performance  information.  However, 
since  the  Department  has  not  vet  developed  a  new  performance  measure,  we 
have  not  yet  directly  tested  the  use  of  data  supporting  any  performance  report 
results. 


0 

0* 
*) 
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Since  the  Department  decided  not  to  proceed  with  the  Reforestation  rate  in 
harvested  areas  performance  measure,  the  part  of  our  recommendation  dealing 
with  the  target  for  that  measure  is  no  longer  relevant. 

Implications  and  risks  if  recommendation  not  implemented 

If  the  Department  does  not  measure  and  publicly  report  reforestation  outcomes, 
the  public  will  not  have  assurance  that  industry  is  complying  with  reforestation 
standards  or  that  the  standards  themselves  are  stringent  enough  to  ensure 
satisfactory  reforestation. 

4.2  Monitoring  and  enforcement — satisfactory  progress 
Background 

In  our  2005-2006  Annual  Report  (No.  15 — vol.  1,  page  122),  we  recommended 
that  the  Department  strengthen  its  monitoring  of  reforestation  activities  by: 

•  bringing  more  rigour  to  the  review  of  forestry  operator  plans, 

•  making  its  field-inspection  program  more  effective,  and 

•  promptly  identifying  and  correcting  non-compliance  with  legislation. 

We  had  found  that  harvest  and  silviculture  plans  submitted  by  operators 
annually  were  not  consistently  reviewed  and  there  was  no  process  to  follow  up 
on  problems.  In  a  few  cases,  forestry  offices  could  not  find  operating  plans.  The 
Department  did  not  have  a  risk-based  system  to  identify  where  to  deploy  its 
monitoring  resources.  At  the  time  of  our  audit,  the  Department  was  behind  on 
its  non-compliance  reviews  and  its  enforcement  goals  were  not  clear. 

Criteria:  the  standards  we  used  for  our  audit 

The  Department  should  have  processes  to  ensure  that  forestry  operators  reforest 
harvested  lands  in  accordance  with  the  regulatory  standards. 

The  Department  should  monitor  compliance  with,  and  enforce,  its  reforestation 
regulatory  standards. 

Our  audit  findings 

Monitoring  for  compliance — the  Department  designed,  and  is  implementing,  a 
formal  system  of  quality  control  and  quality  assurance  to  improve  its 
monitoring  system. 

The  Forest  Operations  Monitoring  Program  (FOMP)  includes  guidance  and 
forms  for  forestry  branch  staff  to  use  when  carrying  out  monitoring  and 
compliance  activities.  A  key  activity  in  FOMP  is  the  Department's  staff  review 
of  operators'  compliance  with  annual  harvest  and  silviculture  plans.  It  also 
includes  a  selection  process  using  risk-based  criteria. 
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Some 

implementation 
issues 


We  visited  four  field  offiees  and  re\  iewed  1  S  operator  tiles  to  \erif\  that 
Department  staff  w  ere  following  the  FOMP  processes  and  forms.  The 
Department  first  used  the  new  processes  and  forms  in  200N.  While  e\  idence 
shows  that  the  FOMP  implementation  is  progressing  in  the  field,  we  saw  that 
field  staff  are  still  learning  the  new  processes  and  forms,  lor  example,  we  found 
forest  officers  w  ere  using  an  old  version  of  the  annual  operating  plan  checklist 
instead  of  the  new  one  in  one  of  the  four  offices.  We  also  found  inconsistency 
in  the  interpretation  of  a  FOMP  requirement  to  perform  a  minimum  number  of 
on-site  inspections  of  performance  surveys  for  each  operator. 


Management 
committed  to 
independent 
eertitleation  of 
quality  control 
system 


Management  has  committed  to  a  quality  assurance  component  for  FOMP. 
Management  will  obtain  ongoing  independent  eertitleation  that  the  quality 
control  system  is  operating  to  internationally  recognized  standards.  At  the  time 
our  work  was  completed  in  December  2008.  management  had  alreadv  had  a 
pre-certification  assessment  completed  by  an  independent  auditing  firm  and 
planned  to  obtain  certification  in  the  spring  of  2009.  This  quality  assurance 
component  w  ill  help  ensure  that  management  corrects  any  existing 
implementation  issues  and  maintains  its  processes  in  the  future. 


Non-compliance  and  enforcement — the  Department  may  identity 
n o n - c o m p I  i a n ce  t h ro ugh : 

•  Held  office  reviews  of  reports  and  documents  submitted  by  industry . 

•  site  inspections  of  cut  blocks  performed  by  Department  staff,  and 

•  an  annual  compliance  review  of  key  reforestation  activities. 


Warning  or 
penalty  at  the 
discretion  of  field 
officer 


The  Department  has  a  manual  that  describes  the  processes  and  responsibilities 
for  enforcement  actions.  The  manual  provides  guidance  to  staff  on  assessing 
penalties  on  behalf  of  the  Minister  in  cases  when  the  legislation  allows 
discretion  in  whether  to  issue  a  penalty  and  how  much.  The  criteria  for 
assessing  penalties  include  the  operator's  history  of  infractions  and  the  extent  of 
environmental  impact  an  infraction  had.  Decisions  on  whether  to  impose  a 
penalty  must  also  be  reviewed  by  a  supervisor.  We  obtained  evidence  that  these 
processes  are  being  followed  both  in  the  field  and  head  office. 


0 


Also,  when  the  Department  finds  non-compliance  with  operating  requirements 
during  any  of  its  field-office  monitoring  processes,  F<  )MP  requires  it  to 
document  these  issues  in  an  action  plan.  The  Department  discusses  the  action 
plan  with  the  operator  and  follows  up  to  ensure  compliance  issues  are  fixed. 
The  Department  prefers  to  give  operators  the  opportunity  to  fix  issues  and  treats 
FOMP  findings  as  an  education  process  rather  than  an  enforcement  system. 
How  ever,  if  field  office  staff  believe  that  non-compliance  issues  are  significant 
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or  recurring,  they  may  penalize  the  operator  following  the  processes  in  the 
enforcement  manual. 

A  finding  in  our  2006  audit  was  that  the  Department  was  behind  in  its  annual 
compliance  review.  This  was  significant  because  the  Department  can  bring 
enforcement  actions  forward  only  within  a  two-year  period.  Because  the 
Department  was  behind  in  reviews,  compliance  actions  could  not  be  taken 
within  the  two-year  window.  The  purpose  of  this  review,  conducted  from  head 
office,  is  to  identify  operators  who  have  not  completed  planting  and 
regeneration  surveys  within  the  legislated  timelines.  The  review  relies  on  data 
entered  in  AR1S. 

When  we  concluded  our  follow-up  work,  the  Department  had  caught  up  on  its 
reviews  and  was  finishing  its  2007  compliance  review.  Management  indicated 
that,  of  the  issues  detected  through  the  compliance  review,  most  are  data-entry 
errors — rather  than  industry  not  performing  a  reforestation  activity. 
Management  provided  anecdotal  evidence  these  data  entry  errors  have 
decreased  since  our  original  audit,  but  that  the  compliance  review  still  identifies 
a  significant  number  of  data  errors  in  legacy  data.  Since  compliance  findings  are 
not  compiled  and  reported  by  the  number  of  cutblocks  with  compliance  issues, 
management  could  not  readily  show  compliance-issue  trends  across  Alberta. 

In  the  past  the  Department  staff  could  only  ask  operators  to  correct  data  errors 
and  follow  up  with  them  repeatedly  until  the  errors  were  fixed.  However,  in 
2008  the  Timber  Management  Regulation  was  amended  so  that  operators  can  be 
penalized  by  the  Department  for  submitting  inaccurate  or  incomplete  data 
including  their  legacy  data.  The  Department  plans  to  start  penalizing  operators 
for  inaccurate  data  in  2009  when  the  2008  submissions  are  reviewed. 

When  the  review  finds  cases  where  operators  have  not  completed  reforestation 
activities  or  are  late  in  doing  so,  the  Department  decides  whether  to  issue  a 
warning  or  assess  a  monetary  penalty  using  the  criteria  in  the  enforcement 
manual.  Management's  rationale  for  assessing  a  warning  or  penalty  is 
documented  and  approved  by  the  Executive  Director  of  the  Forest  Management 
Branch.  We  reviewed  a  total  of  13  incident  files  from  the  last  four  reviews  and 
found  management  had  completed  the  reviews  and  was  following  the 
enforcement  framework. 

What  remains  to  be  done 

The  Department  will  finish  implementing  this  recommendation  when  it: 

•  obtains  the  quality  assurance  certification  over  the  FOMP  process, 

•  ensures  that  all  field  offices  are  using  the  current  forms  and  processes, 
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•  ensures  staff  are  clear  on  the  minimum  number  of  on-site  performance 
survey  inspections  required,  and 

•  follow  s  through  on  the  plan  to  use  the  penalty  pro\  isions  of  the  Timber 
Management  Regulation  for  inaccurate  regeneration  sur\e\  data. 

Implications  and  risks  if  recommendation  not  implemented 

W  ithout  effective  monitoring  and  enforcement  processes,  the  Department  may 
fail  to  ensure  operators  fulfill  their  reforestation  obligations. 


No  assurance  of 
right  seed  for  right 
area 


4.3  Seed  inventory — satisfactory  progress 
Background 

In  our  2005  2006  Annual  Report  (vol.  1,  page  129),  we  recommended  that  the 
Department  assess  whether  there  was  enough  of  the  right  ty  pe  of  seed  available 
to  reforest  harvested  areas.  Our  own  testing  indicated  that  there  may  not  be 
enough  seed  because  some  operators  that  we  sampled  did  not  have  seed  stored 
at  the  seed  centre. 


Cutblocks  should 
have  seeds  from 
same  zone 


For  trees  to  grow  most  successfully,  a  cutblock  must  be  replanted  with  seeds 
taken  from  the  seed-zone  that  the  cutblock  is  within.  In  our  original  audit,  we 
also  recommended  that  the  Department  strengthen  controls  to  maintain 
seed-zone  integrity  after  the  seeds  left  its  Seed  Centre  for  privately-ow  ned 
nurseries. 


Criteria:  the  standards  we  used  for  our  audit 

The  Department  should  ensure  its  seed  inventory  is  managed  and  maintained  to 
support  reforestation  goals. 


Not  enough  seed 
tor  all  zones 


Our  audit  findings 

The  Seed  Centre's  management  compiled  an  inventory  listing  by  tree  type  and 
seed-zone.  To  forecast  the  amount  of  seed  required  lor  each  type  in  each  /one. 
they  also  compiled  the  amount  of  seed  requested  from  the  Centre  for  each  type 
and  zone  for  the  last  three  years.  They  then  compared  the  inventory  to  the 
forecast  and  concluded  that,  overall,  there  is  enough  seed  for  the  most  common 
ty  pes  of  trees  harvested  in  Alberta.  However,  not  all  zones  have  enough  seed  for 
each  type  of  tree. 


Actual  seed 
requirements 
could  vary  from 
forecast 


We  also  tested  the  inventory  to  the  forecast.  Using  management's  assumption 
that  the  last  three  years  of  activity  is  an  appropriate  predictor  of  future  seed 
requirements,  our  comparison  found  that  management's  conclusion  is 
supported.  As  part  of  the  annual  operating  plan  review,  the  FOMP  process  also 
checks  whether  operators  are  ensuring  they  have  enough  seed  to  meet  their 
reforestation  plans.  Management's  approach  to  comparing  future  seed 
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requirements  to  availability  is  reasonable.  However,  actual  future  requirements 
can  vary  because  operators  amend  harvest  plans  based  on  the  market  prices  for 
specific  types  of  wood  as  well  as  forest  fires  and  pest  impacts. 


Analysis  of  seed 
alternatives  needs 
to  be  done 
formally 


When  an  operator  does  not  have  enough  seed  to  replant  in  a  particular  zone,  it 
can  purchase  seed  from  the  Department  or  another  operator  if  available.  If  seed 
is  not  available  from  the  correct  zone,  the  Department  can  authorize  an  operator 
to  use  seed  from  an  adjacent  zone,  which  will  grow  albeit  sometimes  not  as  well 
as  seed  from  the  same  zone.  The  Department  has  not  analyzed  seed  availability 
in  alternate  zones  for  zones  that  are  forecasted  to  be  short  on  seed. 


Seed-zone 
integrity  depends 
on  co-operation  of 
private  nurseries 


To  determine  whether  the  privately-owned  nurseries  have  controls  to  maintain 
seed-zone  integrity,  management  surveyed  23  nurseries  about  their  processes. 
At  the  time  of  our  audit,  management  had  received  18  responses  and  was 
following  up  with  the  remaining  five  nurseries.  Management  plans  to  follow  up 
these  surveys  with  site  visits  in  2009.  After  the  survey  and  inspections  are 
complete,  management  will  be  able  to  assess  if  any  changes  in  policy  or 
processes  are  necessary  to  maintain  seed-zone  integrity  at  the  nurseries. 


What  remains  to  be  done 

The  Department  will  finish  implementing  this  recommendation  when  it: 

•  documents  the  availability  of  seeds  in  alternate  zones  for  the  zones  that 
management  has  identified  a  shortage  of  seed  based  on  its  forecast  or 
operator  harvest  plans,  and 

•  completes  the  nursery  site  inspections  and  concludes  what  additional 
measures,  if  any,  are  necessary  to  ensure  that  seed-zone  integrity  is 
maintained  between  the  Seed  Centre  and  planting. 


Memorandum  of 
Understanding 
(MOU)  needed  to 
clarify 

accountability 


Implications  and  risks  if  recommendation  not  implemented 

Slower  re-growth  or  reduced  yields  could  result  from  using  seeds  from  an 
unmatched  zone. 

4.4  Forest  Resource  Improvement  Association  of  Alberta — implemented 
Background 

In  our  2005-2006  Annual  Report  (No.  16 — vol.  1,  page  127),  we  recommended 
that  the  Department  clarify  its  accountability  expectations  with  the  FRIAA 
through  a  memorandum  of  understanding.  The  Department  did  not  have  a 
strategy  or  cost  estimate  of  how  to  treat  cutblocks  transferred  to  the  FRIAA's 
responsibility  between  1995  and  2000  (legacy  cutblocks).  We  also  found 
reporting  requirements  and  linkage  of  the  FRIAA's  operations  to  the 
Department's  goals  were  unclear. 
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\K)l;  signed 
between 
Department  and 
FRIAA 


Department  will 
re\  leu  FRLA  V 
plans  and 
activities 


Direction  provided 
on  treating  legac\ 
cutblocks 


Our  audit  findings 

The  Department  signed  a  memorandum  tit' understanding  with  the  FRIAA 
establishing  accountability  for  reporting  on  programs.  We  reviewed  an  FRIAA 
business  plan  submitted  to  the  Department  that  describes  how  the  FRIAA's 
programs  relate  to  the  Department's  goals. 

Like  other  operators,  the  FRIAA  prepares  sihiculture  plans  that  the  Department 
reviews.  Also,  the  FRIAA  must  carry  out  performance  surveys  for  cutblocks 
that  it  is  responsible  for.  The  Department  will  review  the  FRIAA's  plans  and 
surveys  through  the  same  FOMP  process  used  for  other  operators.  This  is  the 
process  that  will  \alidate  the  FRIAA's  reforestation  activities. 

The  memorandum  of  understanding  does  not  say  how  the  legacy  cutblocks 
that  are  not  sufficiently  restocked  to  standard  and  that  have  been  transferred  to 
the  FRIAA — will  be  treated.  However,  other  documentation,  including  a 
March  2006  grant  agreement.  pro\  ided  to  us  during  our  audit  and  discussions 
with  management,  indicates  that  overall  the  Department  does  not  plan  to  require 
further  treatments  to  try  to  bring  stocking  up  to  standard  because  in  most  cases 
it  is  impractical  to  do  so  at  this  stage  of  growth.  Instead,  the  FRIAA  will  can\ 
out  performance  surveys  on  these  cutblocks  and  the  Department  w  ill  then  take 
this  updated  information  and  adjust  its  estimate  of  forests  available  for  future 
harvest  and  other  purposes.  The  grant  agreement  provides  the  FRIAA  w  ith 
direction  on  prioritizing  the  use  of  grant  funds  for  blocks  that  can  be  cost 
effectively  treated  to  improve  stocking. 
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Investigation  of  Information 
Technology  incidents 


Need  tor  a  central 
security  office 


Summary 

In  our  October  200S  Public  Report  (page  54),  we  noted  that  the  Government  of 
Alberta  (GOA)  uses  a  distributed,  or  decentralized  approach  to  information 
technology.  Under  this  model,  we  identified  that  while  a  decentralized  approach 
might  work  well  for  program  delivery,  it  posed  significant  challenges  from  a 
security  perspective.  We  recommended  the  establishment  of  a  central  security  office 
to  secure  GOA's  information  assets  (Recommendation  No.  4    page  53). 


Two  IT  incidents 
at  the  Department 
of  Transportation 


Subsequent  to  the  release  of  our  October  200S  Report,  we  were  made  aware  of  two 
incidents  at  the  Department  of  Transportation  that  were  characterized  as  computer 
"penetration"  attempts.  Our  investigation  of  these  incidents  reaffirmed  the  security 
risks  associated  with  usinti  a  decentralized  model. 


Background 

Over  the  past  few  years,  many  organizations,  including  organizations  within  GOA, 
have  outsourced  work  in  their  Information  Technology  (IT)  environments. 
Outsourcing  is  an  effective  way  to  reduce  costs  and  use  the  experience  and  technical 
expertise  of  the  people  doing  the  work.  Although  outsourcing  has  many  benefits,  it 
benefits  and  risks     also  has  risks  because  it  is  difficult  for  management  to  properly  oversee  contractors. 


Outsourcing  IT 
becoming  more 
common 

F.ntails  both 


Department's  IT 
environment 
maintained  jointly 
with  Service 
Alberta 


Service  Alberta  and  the  Department  of  Transportation  (the  Department)  share  the 
responsibility  for  maintaining  the  Department's  IT  environment.  The  Department  is 
responsible  for  maintaining  its  internal  applications,  and  the  maintenance  and 
support  of  its  IT  infrastructure  has  been  outsourced  to  Sen  ice  Alberta. 


Department 
responsible  for 
maintenance 
contract  tor  w  eb 
applications 


The  Department  has  directly  outsourced  maintenance  of  its  web  applications,  and  is 
responsible  for  establishing  and  monitoring  this  contract  with  its  sen  ice  pro\  icier. 
The  IT  infrastructure  that  has  been  outsourced  to  Service  Alberta  includes  routers, 
servers,  and  firewalls.  Service  Alberta  has.  in  turn,  outsourced  specific  maintenance 
activities  for  this  infrastructure  to  other  IT  sub-contractors. 


Service  Alberta  is 
responsible  for 
contractors  that  it 
assigns  to  the 
Department 


As  the  primary  service  provider.  Service  Alberta  is  responsible  to  select  and  approve 
the  IT  contractors  that  it  assigns  to  the  Department,  and  to  o\  ei  see  and  monitor  sub- 
contractors to  ensure  that  they  comply  with  their  contracts  in  performance  of  their 
duties. 
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Department 
responsible  for 
day-to-day 
oversight 


Day-to-day  oversight  of  contractors,  whether  contracted  by  Service  Alberta  or  by 
the  Department  of  Transportation,  is  the  responsibility  of  the  Department  of 
Transportation. 

Computer  systems  maintained  by  these  sub-contractors  were  the  subject  of  the  two 
security  incidents. 


Small  programs 
and  malicious 
software  on 
Department 
computers 


What  we  examined 

The  two  incidents  reported  at  the  Department  were: 

•  small  programs  (also  called  "services'7),  of  unknown  origin,  were  discovered  on 
a  web  server.  They  would  allow  other  computer  code  to  be  run. 

•  malicious  software  was  detected  on  an  important  server  (a  domain  controller). 


Our  objective  was  to  identify  the  cause  or  source  of  these  two  security  incidents. 

Between  February  4  and  27,  2009,  we  reviewed  the  actions  that  the  Department  and 
Service  Alberta  took  after  the  incidents  were  identified. 


Unauthorized 
programs  on  web 
server 


Programs  were  not 
doing  anything 


What  we  found 

The  first  incident  involved  a  contractor  hired  by  the  Department  of  Transportation  to 
maintain  their  web  applications.  The  contractor,  as  part  of  upgrading  a  web  serv  er, 
found  unauthorized  services  running  on  the  web  server.  Services  are  programs  that 
run  in  the  background  without  user  intervention,  designed  to  perform  specific 
functions.  They  can  be  set  to  run  when  the  computer  starts  up  or  be  executed 
manually  when  required.  In  this  case,  many  services  were  started  and  programmed 
to  run  code  located  in  a  temporary  directory.  No  code  was  found  in  the  temporary 
directory  when  it  was  searched,  so  the  services  were  not  actually  doing  anything. 


Source  of — and 
reason  for — 
programs 
unknown  due  to 
lack  of 
investigation 


This  concerned  the  Department  because  neither  the  contractor  nor  Department  staff 
knew  why  the  services  were  there  or  when  they  had  been  installed.  The  Department 
removed  the  services  and  ran  a  virus  scan  on  the  web  server.  It  did  not  find  any 
malicious  software.  After  the  contractor,  hired  by  the  Department,  removed  the 
services  they  did  not  try  to  find  out  where  the  services  came  from.  The  services  may 
have  been  set  up  by  a  previous  contractor  for  testing,  or  for  another  purpose,  or  they 
may  have  been  installed  by  someone  not  authorized  to  do  this.  Because  a  detailed, 
documented  investigation  wasn't  done,  it's  impossible  to  know. 


Malicious 
software 
downloaded  to 
domain  controller 
while  contractor 
did  update 


The  second  incident  involved  the  downloading  of  malicious  software  to  the 
Department's  domain  controller  while  it  was  being  updated  by  a  contractor.  A 
domain  controller  is  a  server  that  enforces  security  rules  for  a  Windows  network  and 
responds  to  user  or  computer  authentication  requests.  In  this  situation,  maintenance 
of  this  domain  controller  was  outsourced  to  Service  Alberta,  which  in  turn 
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outsourced  the  maintenance  acti\  ities  to  a  contractor.  The  contractor  was  logged 
into  the  domain  controller  from  within  the  Department  network  and  used  an  Internet 
brow  ser  to  visit  websites. 


Industry  good 
practice  not 
followed 
contractor 
accessed  Internet 
w  hile  working  on 
domain  controller 


The  Department  stated  that  it  believed  the  contractor  was  trv  my  to  dow  nload 
updated  drivers,  but  in  the  process,  downloaded  a  Trojan  as  well  (a  Trojan  is  a 
malicious  computer  program  that  is  dow  nloaded  w  ith  other  legitimate  programs). 
Industry  good  practices  require  that  when  you  perform  maintenance  on  a  computer 
like  a  domain  controller,  you  should  avoid  surfing  the  Internet — because  of 
weaknesses  in  Internet  browsers  and  the  risks  of  virus  infections.  Several  days  later, 
the  domain  controller  became  unstable  because  of  the  Trojan,  and  Service  Alberta 
was  called  in  to  handle  the  incident. 


Sen  ice  Alberta 
conducted 
investigation:  did 
not  identity  any 
evidence  that  an 
attacker  exploited 
the  s\  stem 


Sen  ice  Alberta  checked  the  domain  controller  and  found  the  Trojan.  Sen  ice 
Alberta  followed  its  incident-response  procedures,  but  could  not  determine  the 
website  from  which  the  Trojan  had  been  downloaded.  It  disconnected  the  domain 
controller  from  the  network,  repaired  the  damage  and  performed  an  investigation. 
The  investigation  did  not  identify  any  evidence  that  an  attacker  may  have  exploited 
the  system.  Neither  the  Department  nor  Serv  ice  Alberta  could  identity  w  hat 
websites  the  contractor  visited. 


Compromised 
domain  controller 
serious — can 
expose  w  hole 
network 


This  incident  is  serious  because  of  the  important  role  the  domain  controller  plays  in 
the  Department  of  Transportation  netw  ork,  [f  this  computer  had  been  compromised, 
it  could  have  been  exploited  to  gain  full  access  to  the  entire  Department  of 
Transportation's  network,  possibly  including  key  business  information  of  the 
Department  of  Transportation. 


Security  practices 
questionable 


Other  observations 

In  the  course  of  conducting  our  investigation,  w  e  became  concerned  w  ith  some  of 
the  security  practices  of  the  service  providers.  For  example: 

•  there  is  no  documentation  explaining  who  installed  the  services  on  the  web 
server,  when  they  were  installed,  or  for  what  purpose. 

•  there  is  no  evidence  that  any  incident  response  procedures  were  followed  hv  the 
Department  of  Transportation  upon  discovery  of  the  unauthorized  services  on 
the  web  server. 

•  the  incident  involv  ing  the  Department  of  Transportation  domain  controller  was 
the  result  of  poor  technical  administrativ  e  practices. 

•  not  all  of  the  information  related  to  the  domain  controller  logs  was  retained  for 
an  adequate  period  of  time,  in  case  this  was  needed  for  follow  up  w  ith  the 

sub  contractors. 


We  w  ill  follow  up  As  a  result  of  these  findings,  we  vv  ill  conduct  a  detailed  review  of  Service  Alberta's 
111  -01 1  and  Departmental  oversight  and  management  of  sub-contractors  in  201  I . 
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Alberta's  consolidated  financia 
statements 

1.  Summary 

We  discuss  several  topics  that  are  important  in  understanding  Alberta's 
consolidated  financial  statements.  Our  goal  is  to  promote  a  better  understanding 
of  the  province's  financial  affairs. 

We  organize  our  discussion  as  follow  s: 

Background  on  the  consolidated  financial  statements 
Specific  topics: 

•  Expanding  the  consolidated  financial  statements 

•  Pensions 

•  P3s 

•  Portfolio  investments  and  derivativ  es 

We  also  note  coming  changes  in  auditing  standards. 

The  consolidated  financial  statements  for  the  year  ended  March  3 1 .  2009,  are 
vet  to  be  prepared  and  audited.  Some  topics  we  discuss  in  this  chapter  may 
change  before  the  financial  statements  of  the  province  for  this  year  are 
completed. 

2.  Background 

The  consolidated  financial  statements  of  the  prov  ince  are  prepared  by  the 
Office  of  the  Controller.  The  consolidated  financial  statements  bring  together 
the  financial  statements  of  individual  ministries,  as  well  as  agencies,  boards  and 
commissions. 

The  Controller  prepares  the  consolidated  financial  statements  in  accordance 
w  ith  generally  accepted  accounting  principles,  as  codified  bv  the  Public  Sector 
Accounting  Standards  Board.  Our  responsibility  is  to  express  an  opinion  on 
w  hether  the  consolidated  financial  statements  are  presented  fairly,  in  all 
material  respects,  in  accordance  with  those  principles. 
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3.  Specific  topics 

Expanding  the  consolidated  financial  statements 

Recent  expansion  Recently,  accounting  standards  changed  to  require  that  governments  include  in 

of  the  government  their  financial  statements  all  organizations  that  they  control,  including  schools, 

universities,  colleges  and  hospitals,  collectively  known  as  the  SUCH  sector. 
The  standard  promotes  accountability  and  transparency  by  presenting  a  more 
comprehensive  picture  of  a  government's  finances. 


reporting  entity 


Governments  were  allowed  some  time  to  transition  to  the  new  standard.  The 
first  phase  was  to  include  the  SUCH  sector  using  a  method  called  modified 
equity  accounting.  The  effect  of  this  accounting,  sometimes  called  "one-line" 
consolidation,  can  be  seen  in  the  2008  consolidated  financial  statements  as 
follows: 


(p.  24  of  the  consolidated  financial  statements) 
Revenues  -  Increase  in  equity  of  Crown-controlled 
SUCH  sector  organizations  $156  million 


(p.  25) 

Financial  assets  -  Equity  in  Crown-controlled 

SUCH  sector  organizations  $3,5 1 9  million 

(p.  49) 

Schedule  8  -  Equity  in  Crown-controlled  SUCH  sector  organizations. 

Schedule  8  provides  explanation  of  the  build  up  and  change  in  the  reported 
equity. 

This  form  of  accounting  will  be  continued  in  the  2009  consolidated  financial 
statements. 


The  deadline  for  the  final  phase  of  transition  is  the  year  ending  March  3 1 ,  2010. 
In  the  2010  consolidated  financial  statements,  Albertans  will  see  what  is  called 
a  "line-by-line"  consolidation  of  the  SUCH  sector.  Instead  of  showing  the 
province's  involvement  as  a  one-line  investment,  the  financial  statements  will 
include  the  SUCH  sector's  revenues,  expenses,  assets  and  liabilities  together 
with  the  rest  of  the  province's  revenues,  expenses,  assets  and  liabilities. 

Net  assets  and  Had  the  province  applied  line-by-line  consolidation  in  the  year  ended 

surplus  will  March  3 1 ,  2008,  net  assets  would  have  increased  by  about  $12  billion  and 

increase  .        ,     ,      ,  ,  • 

annual  surplus  by  about  $2  billion. 
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Accounting 
policies  arc 
harmonized 
during 

consolidation 
process 


Surplus  will  increase  because  of  how  capital  grants  to  the  SUCH  sector  arc 
recorded.  Previously,  capital  grants  were  an  expense  of  the  ministries,  but  not 
revenue  to  the  SUCH  sector  entity  until  the  assets  were  bought,  or  constructed, 
and  used.  With  line-by-line  consolidation,  in  the  consolidated  financial 
statements  these  capital  grants  are  no  longer  considered  an  expense,  but  are 
recognized  for  what  they  are  in  each  SUCH  sector  entity:  either  cash  or  capital 
assets. 

Consolidation  brings  together  the  financial  statements  of  entities  to  produce  one 
set  of  financial  statements.1  To  properly  consolidate  SUCH  sector  entities,  the 
accounting  policies  of  the  SUCH  sector  entities  are  harmonized  with  those  of 
the  province. 

Harmonization  is  a  complex  process.  In  some  instances,  what  is  required  under 
the  accounting  standards  used  by  the  SUCH  sector  is  different  from  what  is 
required  under  government  accounting  standards.  For  example,  art  collections 
are  included  in  the  financial  statements  of  SUCH  sector  entities,  but  are  not 
allowed  to  be  included  in  the  financial  statements  of  governments.  So  when  the 
financial  statements  of  the  SUCH  sector  are  consolidated  into  the  financial 
statements  of  the  province,  art  collections  are  excluded. 


Budget  versus 
actual 

comparisons  may 
chance 


As  explained  above,  the  net  operating  results  of  the  SUCH  sector  arc  currently 
included  as  one  item  in  the  consolidated  financial  statements:  "increase  in 
equity  in  Crown-controlled  SUCH  sector  organizations.*"  This  one  item  is  the 
net  amount  of  SUCH  sector  revenues  and  expenses,  but  there  is  no 
corresponding  budget  amount,  because  Alberta  prepares  its  budget  on  the  basis 
of  immediate  expensing  of  grants  to  the  SUCH  sector  made  by  each  ministry. 


After  the  transition  to  line-by-line  consolidation,  this  one  aggregate  amount  wil 
be  replaced.  Instead,  rev  enues  and  expenses  of  the  SUCH  sector  will  be 
included  in  the  relev  ant  specific  categories  of  the  consolidated  statement  of 
operations.  The  government  is  currently  investigating  the  most  meaningful 
presentation  to  compare  budget  to  actual  amounts. 


1  Alberta's  consolidated  financial  statements  also  include  the  results  of  government  business  enterprises  (GBEs).  but  they  are 
not  harmonized.  GBEs  follow  a  different  set  of  accounting  standards.  GBEs  currently  use  Canadian  private  sector  standards, 
and  will  eventually  transition  to  International  Financial  Reporting  Standards. 


Report  of  the  Auditor  General  of  Alberta 


71 


April  2009 


Financial  statement  and  other  assurance  audits 


Alberta's  consolidated  financial  statements 


Endowments  will 
be  recognized  in 
the  consolidated 
financial 
statements 


Endowments  are  special  kinds  of  donations  to  organizations,  such  as 
universities  or  hospitals,  that  are  made  for  specific  purposes.  Donors  usually 
have  an  expectation  that  the  endowment  assets  will  be  held  in  perpetuity,  and 
maintain  their  value,  with  income  from  the  endowment  assets  being  used  for 
purposes  the  donor  intended. 


Pension  obligation 
is  recorded  in  the 
financial 
statements 


By  including  the  SUCH  sector  endowments  in  the  province's  consolidated 
financial  statements,  the  government  is  not  transferring  the  endowment  assets  to 
itself.  The  endowments  remain  at  the  organizations  to  which  they  are  endowed. 
However,  their  inclusion  in  the  consolidated  financial  statements  will  allow 
Albertans  to  see  the  amount  of  assets  that  has  been  entrusted  to  the  province  to 
be  used  for  specific  purposes. 

Pensions 

The  province  is  trustee  and  sponsor  of  several  public  sector  pension  plans. 
Accounting  standards  require  that  the  province's  consolidated  financial 
statements  include  the  province's  liability  under  pension  plans.  The  liability  is 
the  province's  share  of  the  difference  between  the  assets  that  are  in  the  plans, 
and  the  present  value  of  expected  pension  benefits  to  be  paid.  At 
March  31,  2008,  about  $7.8  billion  in  pension  obligations  was  recorded. 


Understanding 
pension 
assumptions  is 
critical 


Pension  plan  accounting  requires  several  estimates  (plan  assumptions)  about  the 
future.  Important  plan  assumptions  include  inflation,  salary  growth  and  the 
expected  rate  of  return  on  assets  in  the  pension  plan. 


The  financial  statements  of  individual  pension  plans  disclose  sensitivities  of 
changes  in  these  plan  assumptions.  Small  changes  in  these  assumptions  can 
create  large  changes  in  the  pension  obligation  recorded  in  the  financial 
statements.  For  example,  the  financial  statements  of  the  Alberta  Teachers' 
Retirement  Fund  disclose  that  a  0.50%  decrease  in  rate  of  return  on  assets 
would  increase  accrued  pension  benefits  by  about  $517  million. 


Best  estimates  are 
used 


Setting  assumptions  is  a  continual  process  that  results  in  the  assumptions  being 
revised  regularly.  In  this  way,  Albertans  can  be  assured  that  the  recorded 
pension  obligations  are  the  government's  best  current  estimate. 


As  part  of  our  audit,  we  assess  whether  the  assumptions  used  are  reasonable. 
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P3s 

Public-private  partnerships  (P3s).  as  defined  by  the  government,  are  a  form  of 
procurement  for  capital  assets  and  associated  long-term  operations  that  includes 
a  component  of  private  finance.  Payments  to  contractors  arc  performance 
based." 


P3s  are  recorded 
m  the  financial 
statements 


P3s  are  included  in  the  province's  financial  statements,  in  accordance  with 
accounting  standards.  P3  assets  include  the  Fdmonton  and  Calgary  ring  roads 
(Edmonton  opened  in  2007  and  Calgary  in  2009).  At  March  31,  2008  the  value 
of  P3  assets  recorded  was  S679-  million.  The  value  of  both  these  P3  assets  when 
completed  will  be  about  $887  million,  with  an  associated  obligation  of 
$512  million.  The  difference  represents  progress  payments  made  during 
construction. 


P3  contractual 

obligations 

disclosed 


The  consolidated  financial  statements  pro\  ide  additional  P3  disclosures, 
including  amounts  due  under  contractual  obligations,  and  operation  and 
maintenance  payments,  oxer  the  life  of  the  contract. 


The  consolidated  financial  statements,  including  the  disclosures,  arc  in 
accordance  with  accounting  standards. 

Portfolio  investments  and  derivatives 

Portfolio  investments  are  recorded  at  their  cost  in  the  consolidated  financial 
statements  in  accordance  with  accounting  standards.  In  the  main,  these  are  the 
fixed  income  securities  and  equities  held  in  the  I  leritage  Fund,  endow  ments 
such  as  the  Alberta  Heritage  Scholarship  Fund,  the  Alberta  Sustainability  Fund 
and  the  Capital  Account. 


■Other  than 
temporary"  write 
downs  arc 
recorded 


Accounting  standards  require  that  an  asset  be  written  down  (reduction  in  value 
recorded)  if  a  decline  in  value  is  "other  than  temporary."  Given  recent  market 
volatility,  the  government  has  determined  in  its  quarterly  reporting  to  Albertans 
that  the  declines  in  several  investments  are  other  than  temporary. 


Derivative  are 
financial  contracts 


Derivatives  are  financial  contracts  accounted  for  at  the  v  alue  of  underlying 
instruments,  rates  or  indexes  such  as  publicly  traded  securities,  interest  rates, 
currency  exchange  rates,  or  market  indexes.  Derivatives  cover  a  wide 
assortment  of  financial  contracts,  including  forward  contracts,  futures,  options, 
and  swaps.  They  are  used  to  improve  investment  return  and  to  manage  interest 
rate  and  currency  risks.  In  short,  a  derivative  contract  links  its  holder  to  the 
risks  and  reward  of  owning  an  underlying  financial  instrument  w  ithout  actually 


'  P3s  are  defined  in  the  province's  Public  Private  Partnerships  Management  Framework:  Procurement  Process, 
September  2006. 
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Derivatives  are 
recorded  in  the 
financial 
statements 


No  specific 
derivative 
accounting 
standards 


owing  that  instrument.  But  derivative  contracts  carry  the  risk  that  the 
counterparty  will  not  pay  its  obligation  when  it  becomes  due. 

Derivatives  are  recorded  in  the  consolidated  financial  statements  based  on 
whether  or  not  they  are  accounted  for  as  hedges3.  If  derivatives  are  designated 
as  hedges,  gains  and  losses  on  the  derivatives  are  recorded  in  the  same  period  as 
the  gains  and  losses  of  the  specific  assets  being  hedged.  Derivatives  not 
designated  as  hedges  are  recorded  based  on  their  fair  value  at  year  end.  Fair 
value  is  the  amount  that  would  be  paid  or  received  in  settlement  of  the  contract 
at  that  date.  The  fair  values  fluctuate  until  the  derivative  has  matured.4 

Specific  disclosures  of  balances  associated  with  derivatives,  including  gains 
and  losses,  is  not  required  under  PSAB  accounting  standards.5  PSAB  is 
developing  accounting  standards  for  financial  instruments,  and  is  expected  to 
issue  an  exposure  draft  in  June  2009. 

Auditing  standards 

The  Auditor  General,  as  a  member  of  the  auditing  profession,  follows  Canadian 
auditing  standards. 


Auditing 
standards  set  by 
an  independent 
organization 


Auditing  standards  are  set  by  an  independent  organization  called  the  Auditing 
and  Assurance  Standards  Board,  part  of  the  Canadian  Institute  of  Chartered 
Accountants  (OCA).  The  CICA  will  soon  adopt  the  auditing  standards  of  an 
organization  called  the  International  Auditing  and  Assurance  Standards  Board. 


Specific  changes 
coming  to  our 
audit  opinion 


As  the  new  auditing  standards  are  adopted  by  the  Auditor  General,  Albertans 
will  notice  changes.  Our  audit  opinion  will  cover  two  years,  rather  than  one. 
This  is  consistent  with  current  practice  in  much  of  the  private  sector.  Also, 
when  appropriate,  in  our  audit  opinions,  we  may  add  what  is  called  an 
"emphasis  of  matter'  paragraph.  We  will  still  say,  in  our  opinion,  whether  the 
financial  statements  are  fairly  stated.  But  we  will  use  the  additional  emphasis  of 
matter  paragraph  to  draw  attention  to  a  particular  matter  that  we  believe  is 
important  for  readers  of  the  financial  statements  to  consider. 


'  To  hedge  is  to  enter  into  an  additional  contract  designed  to  offset  losses  that  would  arise  if  an  existing  financial  instrument 
declined  in  value. 

4  The  consolidated  financial  statements  disclose  the  notional  amount  for  derivative  contracts.  The  notional  amount  of  a 
derivative  contract  is  the  amount  to  which  a  rate  or  price  is  applied  to  calculate  the  exchange  of  cash  flows.  Notional  amounts 
measure  activity. 

5  The  consolidated  financial  statements  do  not  separately  disclose  derivative  gains  and  losses.  These  gains  and  losses  are 
included  in  net  investment  income.  However,  in  reporting  the  financial  affairs  of  the  province,  the  government  recently 
disclosed  derivative  gains  and  losses  in  the  Alberta  Heritage  Savings  Trust  Fund,  in  the  2008-2009  Alberta  Heritage  Savings 
Trust  Fund  Third  Quarter  Update  (p.  8). 
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Three  common 
themes  from 
audits  of 
Institutions 


Increased  fraud 
risk  at  siime 
Institutions 


Advanced  Education  and 
Technology 

Overview 

This  summary  highlights  three  themes  in  our  recommendations  to  Colleges  and 
Technical  Institutes  (together  referred  to  as  Institutions).  Implementing  these 
recommendations  will  help  Institutions*  Boards  and  Management  to  better  meet 
their  responsibilities.  Management  of  all  Institutions  should  consider  these 
recommendations  and  assess  if  they  can  improve  their  financial  reporting  and 
internal-control  systems.  We  do  not  provide  an  opinion  on  the  effectiveness  of  any 
Institution's  internal-control  systems.  The  themes  are: 

•  improve  financial  reporting — provide  timely,  relevant  and  accurate  financial 
reports  to  senior  management  and  audit  committees. 

•  improve  internal-control  systems    improve  basic  fundamental  internal 
controls  to  safeguard  assets  such  as  cash,  limit  information  systems  access  to 
appropriate  staff,  clarify  and  segregate  roles  and  responsibilities  of  staff,  and 
reconcile  financial  records  promptly  to  ensure  valid  payments,  complete 
revenue  recognition  and  accurate  and  valid  financial  information 

•  preserve  endowment  assets — define  goals  for  the  use.  and  preservation  of  the 
economic  value  of  endow  ment  assets  (to  inflation  proof). 

Summary  of  recommendations 

We  reported  the  internal  control  weaknesses  from  our  financial  statements*  audits  to 
management.  We  did  not  assess  if  the  weaknesses  resulted  in  potential  frauds  in  all 
cases — management  is  responsible  for  this  assessment.  But,  such  weaknesses 
increase  the  risk  of  fraud.  We  report  a  couple  of  cases  w  here  management  informed 
us  of  alleged  fraudulent  activ  ity.  On  page  1 3,  we  also  report  our  assessment  of 
Bow  Valley  College's  investigation  of  an  alleszed  fraud. 


Significant 
internal-control 
weaknesses  at 
Grant  MacEwan 


We  continue  to  report  significant  weaknesses  at  Grant  Mac H wan  College  that 
indicate  an  ineffective  control  env  ironment  for  a  college  of  its  si/e.  The  College 
needs  to  solve  its  staffing  and  information  system  issues,  and  internal  control 
weaknesses.  Until  then  the  College  is  exposed  to  continued  risks  of  fraud  and  error 
going  undetected,  and  inaccurate  financial  information  for  management  and  the 
Audit  Committee. 
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Current  economic     In  the  current  economic  climate,  effective  internal  controls  are  critical  because  of 


climate  increases 
budget  pressure 
and  reduces 
income 


increased  pressures  in  meeting  budgets  and  reduced  investment  income  to  fund 
operations.  These  constraints  may  reduce  Institutions'  abilities  to  hire  the  right  level 
and  number  of  staff,  and  to  implement  effective  internal  controls  and  information- 
technology  controls.  This  increases  Institutions1  risks  of  fraud  and  errors. 


Missed  goals  and 
lower  efficiency 
may  result 


Without  proper  financial  reporting  and  effective  internal  controls.  Institutions  may 
not  manage  business  risks  effectively,  and  may  not  detect  fraud  and  error. 
Additionally,  they  may  not  achieve  their  goals  and  objectives,  use  resources 
effectively  and  efficiently,  or  ensure  reliable  reporting  or  compliance  with  laws. 


Management  and 
Audit  Committee 
need  good 
information 

Several 

recommendations 
made 


Financial  reporting 

Management  needs  timely,  relevant  and  accurate  financial  information  to  run  an 
Institution.  Management  provides  summarized  financial  information  to  an 
Institution's  Audit  Committee  to  allow  it  to  effectively  oversee  and  objectively 
assess  the  Institution's  overall  performance.  Financial  reporting  gives  management 
and  the  Audit  Committee  information  to  deal  with  business  issues  and  risks,  to 
assess  actual  results  against  budget,  and  to  assess  if  the  Institution  is  meeting  its 
objectives  efficiently  and  effectively. 


Bow  Valley 
College 


Bow  Valley  College  should  improve  its  financial  reporting  to  the  Board  by: 

•  including — at  least  quarterly — complete  statements  of  financial  position, 
changes  in  net  assets  and  actual  year-to-date  operating  results. 

•  improving  its  quarterly  processes  and  controls  to  ensure  accurate  financial 
information — see  page  94. 


Medicine  Hat         Medicine  Hat  College  should  improve  its  financial  reporting  to  its  Board  by 
Colle£e  including — at  least  quarterly — complete  statements  of  operations,  financial  position, 

and  changes  in  net  assets — see  page  95. 


Grant  MacEwan 
College 


To  improve  the  accuracy  of  financial  reports  to  management  and  its  Audit 
Committee,  Grant  MacEwan  College  should  improve  its  capital  asset  processes  by: 

•  documenting  its  assessment  of  the  appropriate  accounting  treatment  for  costs 
for  construction  and  renovation  projects. 

•  improving  its  processes  to  code  and  record  transactions  accurately  the  first 
time — see  page  85. 

This  year,  Grande  Prairie  Regional  College  implemented  a  similar  recommendation 
to  improve  its  financial  reporting  and  year-end  processes  (see  page  97),  while 
Alberta  College  of  Art  and  Design  (  ACAD)  has  not  yet  implemented  a  similar 
recommendation  from  our  April  2008  Report  (page  1 80). 
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Basic  elements  of 
internal  control: 

•  restricted 
access 

•  defined  roles 
and  separate 
duties 

•  prompt 
reconciliation 

•  physical 
safeguarding 


Internal-control  systems 

Sonic  basic  elements  of  effect  i\e  internal-control  systems  o\er  pay  roll,  payments 
for  goods  and  sen  ices,  and  revenue  recognition  are: 

•  restricting  access — to  information  systems,  sensitive  documents  such  as 
cheques,  human  resources  and  payroll  records — to  appropriate  staff. 

•  clearly  defining  staff  roles  and  responsibilities  and  segregating  incompatible 
functions  so  that  no  one  person  can  initiate,  approve,  and  record  transactions. 

•  completing  timely  reconciliations  so  financial  records  accurately  reflect  all 
transactions  such  as  revenues,  cash  collected,  and  payments  made. 

•  physically  safeguarding  attractive  assets  such  as  cash  by  restricting  access  to 
appropriate  staff. 


Management  must 
consider  potential 
fraud — as  well  as 
errors 


Management  must  consider  the  risk  of  potential  fraud  or  other  inappropriate  activity 
(theft  of  cash,  payments  to  fictitious  employees  and  suppliers,  misuse  of  resources) 
against  the  Institution,  as  well  as  the  risk  of  errors  in  financial  reports.  A  strong 
control  environment  can  reduce  these  risks  to  an  acceptable  level,  btit  not  eliminate 
them. 


Grant  MacEwan 
College 


Grant  MacEwan  College  should: 

•  improve  its  systems  to  control,  collect,  and  account  for  parking  sen  ices 
fees — see  page  8 1 . 

•  establish  policies  and  procedures  for  issuing  complimentary  memberships  and 
discounts  for  using  the  Sports  and  Wellness  Centre  facilities — see  page  83. 

•  improve  its  system  to  control  and  safeguard  cash  collected  at  sporting 
events — see  page  83. 

•  promptly  reconcile  sub-ledgers  to  the  general  ledger  to  ensure  it  records  all 
transactions  accurately — see  page  84. 


Bow  Valley  In  our  Systems  Audit  section — see  page  13.  we  reported  five  recommendations 

c  olle8e  related  to  improving  internal  controls  on  contracting,  vendor  information 

maintenance  and  defining  the  actions,  responsibilities  and  reporting  requirements 

for  allegations  of  fraud. 


NorQuest  College 


NorQuest  College  should: 

•  improve  its  controls  over  cash  from  tuition  and  student  fees    see  page  87. 

•  improve  controls  to  ensure  that  procurement  cardholders  comph  \\  ith  its 
procurement  card  policy — see  page  88. 

•  ensure  that  its  procurement  card  statements  are  supported  by  adequate 
documentation  and  approved  by  an  authorized  individual  before  making 
payments — see  page  89. 
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NAIT 


NAIT  should  improve  its  processes  to  review  and  approve  staff  procurement  card 
transactions — see  page  90. 


Lakeland  College 


Lakeland  College  should: 

•  adequately  segregate  staff  access  to  the  PeopleSoft  payroll  system  to  ensure 
only  valid  changes  are  made — see  page  91. 

•  review  change  reports  generated  from  the  payroll  system  for 
appropriateness — see  page  91. 

•  prepare  monthly  reconciliations  of  the  payroll  system  to  the  general  ledger  and 
promptly  review  the  reconciliations — see  page  92. 

•  properly  segregate  the  incompatible  functions  of  preparing  and  approving 
journal  entries — see  page  92. 


Mount  Royal 
College 


Mount  Royal  College  should  adequately  segregate  duties  for  processing  payments  to 
casual  and  contract  employees — see  page  93. 


Define  goals  to 
inflation  proof 
endowments 


Endowment  assets 

ACAD,  Grande  Prairie  Regional  College,  Keyano  College,  Lakeland  College, 
Lethbridge  Community  College,  Medicine  Hat  College,  Mount  Royal  College, 
NorQuest  College,  Olds  College,  Portage  College,  and  Red  Deer  College  should 
define  goals  for  the  use,  and  preservation  of  the  economic  value  of  endowment 
assets  (to  inflation  proof) — see  below. 


Our  audit  findings  and  recommendations 

Colleges  and  Technical  Institutes  (Institutions) 
1.    Cross-Institution  recommendations 
1.1  Preserving  endowment  assets 
Recommendation 

We  recommend  that  the  following  Institutions  define  their  goals  for  the 
use,  and  preservation  of  the  economic  value  of  endowment  assets  (inflation 
proofing): 

•  Alberta  College  of  Art  and  Design  (ACAD) 

•  Grande  Prairie  Regional  College 

•  Keyano  College 

•  Lakeland  College 

•  Lethbridge  Community  College 

•  Medicine  Hat  College 

•  Mount  Royal  College 

•  NorQuest  College 
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•  Olds  College 

•  Portage  College 

•  Red  Deer  ( !ollege 


SI 00  million  of 
endow  merits  in 
Colleges  and 
Institutes 


Goal  to  preserve 
economic  value  of 
endowments 


Background 

Public  C  olleges  and  Institutes  in  Alberta  collectively  have  about  SI 00  million 
of  endow  ment  funds  in  long-term  investments,  learnings  from  endow  ment 
investments  support  education,  research  and  teaching.  Each  year.  Institutions 
limit  spending  of  endowment  earnings  to  a  percentage  set  out  in  policies. 
Investment  managers  normally  manage  Institutions'  endowment  funds  in 
accordance  with  policies  and  investment  objectives  set  by  the  Institutions" 
Investment  Committees.  While  some  donors  encourage  spending  all 
endowment  investment  earnings,  other  donors  expect  Institutions  to  preserve 
the  real  value  of  endow  ments  ov  er  time. 


Criteria:  the  standards  we  used  for  our  audit 

Institutions  should  establish  goals  and  performance  measures  for  the 
preservation  of  endowments  and  have  appropriate  administrative  policies  and 
processes  to  help  meet  their  goals. 


Goals  not  set  in 
policy,  or  unclear, 
or  not  followed 


Our  audit  findings 

We  found  that: 

•  Grande  Prairie.  Lakeland.  Medicine  Hat.  NorQuest,  Olds  and  Portage  do 
not  have  policies — nor  have  they  clearly  defined  their  goals  on 
presen  ing  the  economic  value  of  endow  ments. 

•  ACAD.  Lakeland.  Lethbridge  and  Mount  Royal  have  policies  for 
capitalizing  investment  income  to  endowments,  but  it  is  unclear  if  the 
intent  is  to  partly  or  fully  protect  the  economic  value  of  endowments. 

•  Keyano  has  a  policy  to  protect  the  economic  value  of  endowments,  but  it  is 
not  adhering  to  its  policy. 


No  rev  iew  of 
spending  policies 
to  ensure 
sustainability 


Institutions  have  not  rev  iewed  or  have  just  started  to  review  their  spending 
policies  to  assess  if  current  spending  levels  are  appropriate  and  sustainable  over 
the  long  term. 


Economic  value 
may  not  be 
preserved 


Implications  and  risks  if  recommendation  not  implemented 

Without  a  clear  definition  of  the  goals,  performance  measures  and  policies  to 
protect  the  economic  v  alue  of  endowments,  Institutions  may  not  generate 
sufficient  income  to  support  education,  research  and  teaching  and  meet  donors' 
wishes. 
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Department  had  to 
provide  guidance 
to  Institutions  on 
IT  controls 


1.2  Colleges  and  Technical  Institutes  computer  controls — progress  report 
Background 

Well-designed  and  effective  information  technology  controls  give  Institutions 
assurance  over  the  security  and  integrity  of  their  information  and  systems. 
These  systems  are  used  for  financial  reporting  and  to  provide  efficient, 
effective,  and  reliable  services  to  students  and  staff.  In  our  April  2008  Public 
Report  (No.  8 — page  195),  we  recommended  that  the  Department  of  Advanced 
Education  and  Technology  give  guidance  to  Institutions  on  using  an  IT  control 
framework  to  develop  control  processes  that  are  well-designed,  efficient,  and 
effective.  We  also  provided  a  summary  of  findings  for  IT  controls  at 
Institutions. 


Department 
developed  IT 
control  framework 


Management's  actions — The  Department,  working  with  Institutions,  has 
developed  an  Institution  Information  and  Technology  Management  Control 
Framework  (the  framework),  and  a  proposal  to  implement  it.  We  have  reviewed 
the  implementation  proposal  and  agree  that  if  Institutions  properly  implement 
the  framework,  it  should  resolve  our  previous  concerns. 


Institutions — 
except 
Bow  Valley, 
Grande  Prairie  and 
Northern  Lakes — 
made  progress 

ACAD  and 
NorQuest  made 
significant 
progress 


Overall,  Institutions  are  making  progress  on  prior  recommendations,  and  we 
made  fewer  new  recommendations  this  year.  But,  we  had  to  repeat 
recommendations  made  in  management  letters  at  three  Colleges — Bow  Valley, 
Grande  Prairie  and  Northern  Lakes — because  of  unsatisfactory  progress 
implementing  recommendations  within  a  reasonable  time.  Alberta  College  of 
Art  and  Design  and  NorQuest  made  significant  progress  resolving  problems 
and  improving  controls  this  past  year. 

We  also  audited  Lethbridge  College's  IT  controls  this  year  using  the  same  audit 
approach  as  the  other  institutions  and  recommended  that  it: 

•  conduct  a  risk  assessment  and  use  an  IT  control  framework  to  develop  and 
implement  effective  IT  controls. 

•  implement  well-designed  and  effective  access  and  change-management 
controls. 


Benefits  of  shared 
systems  being 
realized 


Institutions  are  realizing  that  using  shared  systems  and  infrastructures,  and 
common  IT  control  processes  is  an  efficient  and  effective  way  to  provide 
secure,  programs  and  services  to  students  and  staff.  We  support  the  Department 
and  Institutions'  plan  to  develop  and  implement  a  standardized  IT  control 
framework  and  use  shared  systems  and  infrastructure. 


Report  of  the  Auditor  General  of  Alberta 


April  2009 


Financial  statement  and  other  assurance  audits 


Advanced  Education  and  Technology 


Significant 
weaknesses  persist 

Ineffective 
internal  controls 

C  ollege  started 
project  for 
financial 
processes  and 
controls 


2.    Recommendations  to  individual  Institutions 

2.1  Grant  MacEwan  College 

We  continue  to  report  a  number  of  significant  weaknesses  at  the  C  ollege.  These 
indicate  an  ineffective  control  environment  for  a  college  of  Us  si/e.  In  our 
April  200S  Report  (page  KS7).  we  reported  that  the  C  ollege  had  initialed  a 
Financial  Information  Management  Enhancement  Project  to  work  on  broader 
financial  processes,  systems  and  personnel  issues.  The  College  issued  a  request 
for  proposal  to  select  a  new  information  technology  system,  and  plans  to  start 
implementing  the  new  system  later  this  year.  The  College  has  made  staff 
changes  in  the  Financial  Services  area,  and  started  to  document  its  business 
processes.  However,  it  continues  to  work  on  hiring  the  right  number  and  level 
of  staff  and  refining  its  business  processes. 


Significant 
weaknesses  in 
inventory  and 
petty  cash 
unresolved  from 
September  2007 


On  page  186  of  our  April  2008  Report,  we  recommended  that  the  College 
improve  its  systems  to  manage  inventories  and  petty  cash.  We  also  said  that 
management  informed  us  of  a  forensic  investigation  into  the  management  of  its 
various  stores.  Management  continues  to  improve  internal  controls  related  to 
inventory  and  petty  cash,  and  to  finalize  its  forensic  investigation.  [Because  the 
weaknesses  were  significant,  management  should  have  finished  improvements 
to  internal  controls  and  its  forensic  investigation  by  now — we  first  discussed 
these  weaknesses  with  management  in  September  2007. 


College  needs  to 
resolve  staffing, 
process,  and 
control  issues 


Implementing  the  new  system  efficiently  and  effectively,  on  time  and  on 
budget,  depends  on  sufficient,  appropriately  skilled  staff,  and  documented 
policies  and  procedures  for  business  processes  and  internal  controls.  The 
College  needs  to  solve  its  staffing  and  information  systems  issues,  and  the 
internal  control  weaknesses.  Until  then,  the  College  is  exposed  to: 

•  continued  risks  of  fraud  and  error  going  undetected,  and 

•  inaccurate  financial  information  for  management  and  the  Audit  Committee. 


The  College  also  risks  not  implementing  its  new  information  technology  system 
effectively  and  efficiently,  on  time  and  on  budget. 
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2.1.1     Parking  services  fees 
Recommendation 

We  recommend  that  Grant  MacEwan  College  improve  its  systems  to 
control,  collect,  and  account  for  parking  services  fees. 


College  charges 
for  parking 


Background 

The  College  collects  parking  fees  from  parking  meters,  pay-on-foot-machines, 
parking  booths,  over-the-counter  transactions  at  the  City  Centre  Campus 
parking  office,  and  deductions  from  staff  salaries.  It  accepts  various  forms  of 
payment  including  cash,  debit  and  credit  cards. 


Criteria:  the  standards  we  used  for  our  audit 

The  College  should  have  effective  controls  over  parking  services,  including  the 
collection  and  recording  of  parking  services  fees  and  fines. 


Inadequate 
controls  for 
collecting  parking 
fees 


Our  audit  findings 

We  found  the  following  control  problems  related  to  collecting  parking  fees: 

•  physical  access  controls  were  poor:  parking  attendants  had  access  to  both 
the  containers  required  to  remove  cash  from  the  parking  machines  and  the 
designated  keys  for  the  machines;  they  could  bypass  the  need  for  two 
people  to  be  present  when  removing  cash  from  the  machines. 

•  no  documentation  supported  the  reconciliation  of  cash  collected  from 
parking  meters  and  pay-on-foot-machines  to  the  reports  generated  by  these 
machines  to  ensure  that  the  College  deposited  all  cash  received  in  its  bank 
account. 

•  reconciliations  of  cash  collected  over-the-counter  at  the  City  Centre 
Campus  parking  office  with  the  report  generated  by  the  point-of-sale 
terminals  were  not  prepared.  This  reconciliation  would  help  ensure  that  the 
College  deposits  all  cash  received  in  its  bank  account,  and  records  all 
parking  fees  and  fines  in  its  financial  reports. 


$738,000  parking 
fines  from  1999  to 
2008  not 
previously 
pursued  or 
recorded — 
$380,000 
uncollectable 


The  College  did  not  pursue  nor  record  parking  fines  totaling  $738,000  from 
1999  to  March  2008.  Although  the  College  may  have  collected  fine  payments 
during  this  period,  the  College  cannot  determine — because  of  poor 
documentation  and  processes — if  it  deposited  the  cash  that  it  did  collect  for 
parking  fines  during  this  period,  in  the  College's  bank  accounts.  The  College 
recorded  the  $738,000  this  year,  then  wrote  off  $380,000  as  uncollectable. 
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Management  to 
assess  and 
investigate  it"  fraud 
or  theft  occurred 


We  reported  the  internal  control  w  eaknesses  from  our  financial  statements 
audits  to  management,  so  they  can  assess  and  investigate  it* the  weaknesses  may 
have  resulted  in  fraud  occurring.  We  did  not  assess  or  investigate  it  fraud 
occurred.  In  our  view  ,  the  w  eaknesses  increase  the  risk  of  fraud  or  other 
inappropriate  acti\  it) . 


Implications  and  risks  if  recommendation  not  implemented 

Inadequate  processes  and  lack  of  sufficient  review  s  increase  the  risk  of  fraud 
and  error  going  undetected  and  loss  of  revenue. 

2.1.2     Sports  and  Wellness  Centre 
Recommendation 

We  recommend  that  Grant  MacEwan  College: 

•  establish  policies  and  procedures  for  issuing  complimentary 
memberships  and  discounts  for  using  the  Sports  and  \\  ellness  Centre 
facilities. 

•  improve  its  system  to  control  and  safeguard  cash  collected  at  sporting 
events. 


College  sports 
centre  for  students 
and  public 


Background 

The  C  ollege's  Sports  and  Wellness  Centre  (the  Centre)  offers  recreational 
activities  to  students,  staff,  and  the  public.  The  Centre  has  different  rates  for  the 
public,  staff,  and  day-pass  drop-ins. 


Ticket  sales  to 
sporting  events 


The  College  collects  cash  by  selling  tickets  to  sporting  events  such  as  hockey, 
v  olleyball,  and  basketball.  It  also  sells  merchandise  at  these  events. 


Criteria:  the  standards  we  used  for  our  audit 

The  College  should  have  effective  controls  for  the: 

•  rates  charged  and  payments  collected  for  the  use  of  the  Centre's  facilities. 

•  collection  and  safeguarding  of  cash  at  sporting  events. 


Variances  in 
expected 
membership 
revenue 

$54,000  difference 
for  one  type  of 
membership 


Our  audit  findings 

Our  analysis  of  the  Centre's  membership  pass  revenue  recorded  in  the  financial 
statements  for  the  year  ended  June  30,  2008.  showed  that  the  College  did  not 
collect  the  expected  revenue  for  passes  issued.  For  example,  it  issued  220  adult 
annual  passes  for  public  memberships  under  Plan  A  (for  unlimited  use  of 
facilities).  But  the  College  recorded  revenue  of  about  $55,000  for  this  category 
rather  than  expected  revenue  of  about  $109,000.  based  on  the  yearly  fee. 
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No  policies  or 
approval  of 
discounts  and 
complimentary 

passes 


Staff  told  us  the  difference  represents  complimentary  passes  issued  or  discounts 
to  members.  We  did  not  see  documentation  supporting  who  approved 
complimentary  passes  or  identifying  what  criteria  staff  used  to  determine  who 
qualifies  for  complimentary  passes  or  discounts.  The  College  does  not  have 
clear  policies  and  guidelines  for  issuing  complimentary  passes  and  giving 
discounts. 


Poor  segregation 
of  duties  to  collect 
cash  at  sporting 
events 


Poor  safeguarding 
of  cash  at  sporting 
events 


Our  discussion  with  Sports  and  Wellness  staff  also  determined  the  following: 

•  Poor  segregation  of  duties  for  collecting  cash  at  sporting  events — the  ticket 
seller  at  sporting  events  also  tracks  attendance  on  a  tally  sheet.  Since  the 
tickets  issued  are  not  pre-numbered  and  ticket  stubs  are  not  kept,  an 
independent  person  cannot  reconcile  tickets  sold  to  the  tally  sheet  to  ensure 
the  College  deposits  all  cash  collected  in  its  bank  accounts. 

•  Poor  safeguarding  of  cash  collected  at  sporting  events — staff  keeps  the 
cash  in  unlocked  boxes.  In  addition,  cash  collected  at  hockey  games 
remains  with  the  event  supervisor  over  the  weekend  as  games  are  usually 
off  campus. 


Forensic 

investigations 

occurred 


Management  informed  us  of  two  separate  forensic  investigations  in 
January  2008  and  March  2009  related  to  the  Sport  and  Wellness  Centre. 

Implications  and  risks  if  recommendation  not  implemented 

Inadequate  processes  and  lack  of  sufficient  reviews  increase  the  risk  of  fraud 
and  error  going  undetected,  and  loss  of  revenue. 

2.1 .3     Prompt  completion  of  sub-ledger  reconciliations 
Recommendation 

We  recommend  that  Grant  MacEwan  College  promptly  reconcile 
sub-ledgers  to  the  general  ledger  to  ensure  it  records  all  transactions 
accurately. 


Three  sub-ledgers 
used  in  various 
business  processes 

Automatic 
transfers  to 
general  ledger 


Background 

The  College  uses  the  Datatel  information  system  to  process  accounts  payable 
and  accounts  receivable  transactions.  These  transactions  are  automatically 
transferred  from  the  accounts  payable  and  accounts  receivable  sub-ledgers  to 
the  general  ledger  overnight.  The  College  uses  the  Ratex  Bookstore  system  to 
track  bookstore  inventory  and  records  this  inventory  in  the  general  ledger.  The 
College  records  convenience  store  inventory  based  on  the  results  of  monthly 
physical  counts. 
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Criteria:  the  standards  we  used  for  our  audit 

The  College  should  reconcile  the  accounts  payable,  accounts  receivable,  and 
inventories  sub-ledgers  to  the  general  ledger  to  ensure  all  transactions  are 
recorded  in  the  general  ledger.  An  independent  person  should  review  and 
approve  each  reconciliation. 


Reconciliations 
not  completed,  not 
timel) .  not 
re\  iew  ed 


Our  audit  findings 

The  College  did  not  promptly  complete  and  review  reconciliations  for  the 
accounts  payable  sub-ledger  to  the  general  ledger,  accounts  receivable 
sub-ledger  to  the  general  ledger,  and  inventory  tracking  system  and  the  general 
ledsicr. 


Reconciliations 
help  detect  fraud 
and  errors 


$138,000  written 
off  after  delayed 
reconciliation 


In  a  well-controlled  organization,  timely  reconciliations  are  important  controls 
to  ensure  all  transactions  are  accurately  reflected  in  the  financial  records,  and  to 
detect  possible  fraud  and  errors.  Reconciliations  help  ensure  the  accuracy  and 
completeness  of  financial  information  presented  to  management  and  the  Audit 
Committee.  For  example,  in  our  April  2008  Public  Report  (page  1 86).  w  e  noted 
that  the  College  was  unable  to  account  for  its  stock  of  transit  passes  and  bus 
tickets  of  about  $32,000.  These  passes  and  tickets  related  to  inv  entory  held 
before  July  1,  2007.  The  College  was  only  able  to  quantify  the  full  extent  of  the 
w  rite  off  this  year,  after  completing  a  detailed  inventory  count  and 
reconciliation  of  the  inventory  tracking  system  to  the  general  ledger  as  at 
March  3 1.  2008.  The  write  off  was  about  $138,000. 


Implications  and  risks  if  recommendation  not  implemented 

Lack  of  regular  reconciliations  of  sub-ledgers  to  the  general  ledger  may  result 
in  misstatement  of  financial  statements  and  undetected  fraud  and  error. 

2.1.4     Capital  assets 
Recommendation 

W  e  recommend  that  Crant  MacKwan  College  improve  its  capital  asset 
processes  by: 

•  documenting  its  assessment  on  the  appropriate  accounting  treatment 
for  costs  related  to  construction  and  renovation  projects. 

•  coding  and  recording  transactions  accurately  the  first  time. 
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Construction  and 
renovation 
projects  underway 


Background 

The  College  has  a  number  of  construction  and  renovation  projects  underway, 
including  space  enhancements  in  the  Robbins  Health  Learning  Centre, 
expansions  to  facilities  for  new  degree  programs,  and  construction  of  new 
laboratories.  Its  Capital  Asset  Recognition  and  Valuation  Guideline  has 
information  on  when  to  capitalize  or  expense  certain  costs  for  four  different 
types  of  expenditures. 


Criteria:  the  standards  we  used  for  our  audit 

The  College  should  have  processes  that  facilitate  complete  and  accurate 
recording  for  capital  assets. 


Correct  recoding 
of  costs  affect 
accuracy  of 
financial 
information 


Our  audit  findings 

The  accuracy  of  financial  information  presented  to  management  and  the  Audit 
Committee  is  dependent  on  recording  costs  correctly.  This  allows  management 
and  the  Audit  Committee  to  monitor  if  the  College  is  meeting  its  budget,  and  to 
determine  the  value  of  its  assets  used  in  delivering  programs  to  students. 


Transactions 
incorrectly 
recorded  and  then 
recoded  much 
later 


The  Facilities  Department  codes  all  construction-related  costs — capital  or  not— 
to  capital  asset  work-in-progress  in  the  general  ledger.  After  the  initial  entry, 
the  Facilities  Department  recoded  transactions  between  various  projects  and 
accounts.  At  year-end,  Financial  Services  reviewed  all  the  codes  to  determine 
those  costs  that  are  repairs  and  maintenance  in  nature,  and  transferred  the  costs 
to  expense  accounts  in  the  general  ledger. 


Financial 
information 
inaccurate 
throughout  year 
by  $3.5  million 


Time  wasted  to 
correct  avoidable 
eirors 


The  College  concluded  that  it  incorrectly  coded  expenses  of  $1.8  million  for  the 
Robbins  Health  Learning  Centre  parkade,  resulting  in  adjustments  to  the 
financial  statements.  We  noted  more  errors  totaling  about  $1 .7  million — the 
College  had  expensed  them  as  repairs  and  maintenance,  but  should  have 
capitalized  them.  Of  this  amount,  the  College  adjusted  the  financial  statements 
for  $856,000.  Staff  spent  significant  time  investigating,  compiling,  and 
correcting  financial  reporting  errors  that  they  could  have  avoided  with  properly 
designed  and  implemented  controls.  It  should  determine  the  proper  coding  at 
the  start  of  a  project  and  enter  transactions  to  the  correct  account  the  first  time. 
The  time  spent  correcting  preventable  errors  reduces  the  sustainability  of 
business  processes  as  resources  get  diverted  from  regular  duties  to  correct  the 
errors.  In  addition,  management  and  the  Audit  Committee  did  not  have  reliable 
financial  information  throughout  the  year  because  it  only  made  the  corrections 
at  year-end. 
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Implications  and  risks  if  recommendation  not  implemented 

Inefficient  and  ineffective  business  processes  are  not  cost-effective  or 
sustainable  and  may  cause  significant  misstatements  in  financial  statements. 

2.2  NorQuest  College 

2.2.1     Internal  controls  over  cash 
Recommendation 

We  recommend  that  NorQuest  College  improve  its  controls  over  cash 
received  from  tuition  and  student  fees. 


Registrar's  office 
collects  tuition 
payments  and 
fees,  and  cashes 
bursary  cheques 


Background 

The  Registrar's  Office  receives  tuition  payments  and  other  student  fees  for  the 
College.  The  College  lets  students  cash  their  bursary  cheques  at  the  Registrar's 
Office  and  refunds  the  students  in  cash — from  a  cash  float — for  the  amount  by 
w  hich  the  bursary  cheques  exceeds  the  amount  students  owe  the  College.  The 
College  maintains  the  cash  float  at  its  limit  by  remov  ing  cash  from  daily  cash 
receipts.  Staff  are  expected  to  record  cash-float  withdraw  als  and  replenishments 
in  a  daily  logbook. 


Criteria:  the  standards  we  used  for  our  audit 

The  College  should  promptly  follow  up  and  investigate  cash  shortages  and 
differences  between  cash  received,  deposits  in  its  bank  accounts  and  amounts 
recorded  in  its  general  ledger. 


All  employees  can 
access  cash  float 
and  duil>  receipts 

S4.000  cash  taken 
without  support 


Our  audit  findings 

The  College  does  not  have  adequate  controls  over  cash  receipts.  All  seven 
employees  in  the  Registrar's  Office  can  access  the  cash  float  and  daily  cash 
receipts.  In  four  of  25  samples,  cash  of  about  $4,000  w  as  taken  from  the  daily 
cash  receipts  without  documentation  explaining  who  replenished  the  cash  float, 
and  w  hen.  The  Registrar's  Office  staff  assumed  the  cash  was  used  to  maintain 
the  cash  float  at  its  limit.  No  evidence  supported  this  assumption.  Financial 
Services  recorded  these  amounts  as  cash  shortages  in  the  general  ledger. 


No  ev  idence  cash 
shortages  or 
overages 
investigated 

Net  cash  shortage 
reduced  to  SI. 400 


There  is  no  evidence  that  Financial  Services  staff  review  the  deposit  slips  when 
they  perform  the  bank  reconciliation,  or  investigate  cash  shortages  and 
overages.  Nor  is  there  evidence  of  a  reconciliation  of  the  cash  float,  or  of  any 
review  of  a  reconciliation.  The  net  cash  shortage,  expensed  in  the  financial 
statements  for  the  year  ended  June  30,  2008,  was  about  $1,400.  We  did  not  test 
the  cash  ov  erages  that  reduced  the  net  cash  shortage  to  only  $  1 .400  for  the  year. 
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Management  to 
assess  and 
investigate  if  fraud 
occurred 


We  reported  the  internal  control  weaknesses  from  our  financial  statements 
audits  to  management,  so  they  can  assess  and  investigate  if  the  weaknesses  may 
have  resulted  in  fraud  occurring.  We  did  not  assess  or  investigate  if  fraud 
occurred.  In  our  view,  the  weaknesses  increase  the  risk  of  fraud. 


Implications  and  risks  if  recommendation  not  implemented 

Ineffective  controls  over  cash  receipts  may  result  in  misappropriated  cash. 


College  uses 
procurement  cards 
to  buy  goods  and 
services 


2.2.2     Procurement  cards — discrepancy  log 
Recommendation 

We  recommend  that  NorQuest  College  improve  controls  to  ensure  that 
procurement  cardholders  comply  with  its  procurement  card  policy. 
Background 

The  College  uses  procurement  cards  to  buy  goods  and  services.  The 
procurement  card  policy  does  not  permit  staff  to  split  purchases  into  smaller 
units  to  circumvent  card  limits.  Financial  Services  may  terminate  people's  card 
privileges  if  they  abuse  them. 


Compliance  with 
policy  monitored 
and  enforced 


The  College  processes  require  the  Procurement  and  Inventory  Coordinator  to 
maintain  a  discrepancy  log  to  record  non-compliance  with  the  procurement  card 
policy  before  processing  the  payment.  The  Procurement  and  Inventory 
Coordinator  records  violations  in  the  log,  issues  a  warning  to  a  cardholder  and 
notifies  the  Manager  of  Financial  Services.  After  three  warnings,  the  Manager 
of  Financial  Services  will  terminate  the  card. 


Criteria:  the  standards  we  used  for  our  audit 

The  College  should  maintain  a  record  of  non-compliance  with  the  procurement 
card  policy  and  follow  up  on  it  to  ensure  compliance. 


One  transaction 
split — against 
policy — to  appear 
to  comply  with 
policy 


Our  audit  findings 

We  examined  two  cardholder  statements  for  October  2007  and  June  2008.  In 
one,  the  cardholder  charged  $  1 ,000 — although  they  had  signed  an  agreement 
limiting  their  purchases  to  $500.  The  cardholder  claimed  a  single  purchase  as 
two  purchases  of  $500  each.  A  supervisor  approved  it,  and  it  was  then  paid  and 
recorded  in  the  general  ledger.  There  was  no  evidence  of  any  follow-up,  and  no 
documentation  in  the  discrepancy  log  of  the  transaction  splitting.  The  purchase 
was  a  valid  College  expenditure. 
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Discrepancy  log 
not  completed 
since  March  200S 


Due  to  staff  changes,  the  current  Coordinator  was  unaware  of  the  discrcpancv 
log.  Subsequently,  we  received  a  eopv  of  the  discrepancy  log  from  an 
accounting  super\  isor  in  financial  Ser\  ices.  It  was  completed  onlv  to  the  end  of 
March  2008. 


Implications  and  risks  if  recommendation  not  implemented 

The  College  may  record  inappropriate  or  personal  expenditures  if  the 
procurement  card  policy  is  not  followed,  or  if  expenses  that  do  not  comply  with 
the  policy  are  claimed  and  paid. 

2.2.3     Procurement  cards — compliance  with  procurement  card  policy 
Recommendation 

We  recommend  that  NorQuest  College  ensure  that  its  procurement  card 
statements  are  supported  by  adequate  documentation  and  are  approved  by 
an  authorized  individual  before  making  payments. 


College  uses 
procurement  cards 
to  buy  goods  and 
services 

Coordinator 

verities 

compliance 


Background 

The  College  uses  procurement  cards  to  buy  goods  and  services.  The 
procurement  card  policy  requires  the  cardholder  and  the  budget  manager  to  sign 
the  procurement  card  statement  before  payments  are  processed.  The 
Procurement  and  Inventor)  Coordinator  verifies  that  cardholders  provided 
supporting  documentation  for  all  transactions  and  ensures  that  authorized 
individuals  approved  the  transactions  before  processing  the  payment. 


Criteria:  the  standards  we  used  for  our  audit 

The  College  should  ensure  procurement  card  purchases  are  supported  by 
appropriate  documentation  and  approved  by  authorized  indiv  iduals. 


Payments 
processed  without 
supporting 
receipts,  contrary 
to  policy 


Our  audit  findings 

In  six  of  50  cardholder  statements  tested,  cardholders  did  not  provide  detailed 
receipts  for  amounts  claimed  and  authorized  indiv  iduals  did  not  re\  ie\\  and 
approv  e  the  transactions  to  ensure  they  are  v  alid  business  expenses.  The 
Procurement  and  Inventory  Coordinator  processed  and  paid  these  transactions. 


Implications  and  risks  if  recommendation  not  implemented 

Without  an  adequate  process  for  reviewing  and  approv  ing  procurement  card 
statements,  the  College  may  pay  for  unauthorized  and  personal  expenditures. 
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2.3  Northern  Alberta  Institute  of  Technology — Review  of  procurement  card 
transactions 
Recommendation 

We  recommend  that  the  Northern  Alberta  Institute  of  Technology  improve 
its  processes  to  review  and  approve  staffs  procurement  card  transactions. 


College  uses 
procurement  cards 
to  buy  goods  and 
services 


Background 

The  Institute  provides  employees  with  procurement  cards  as  a  method  of 
purchasing  and  paying  for  low-value  purchases.  To  obtain  a  card,  employees 
must  receive  approval  from  their  supervisor.  During  the  application  process,  the 
employee  acknowledges  in  writing  they  will  comply  with  the  Institute's 
procurement  card  policy. 


Policy  sets  card 
and  transaction 
limits 


This  policy  states  that  card  limits  are  set  at  $750  per  transaction.  The  policy 
also  states  that  cardholders  should  never  split  transactions.  The  Institute's 
central  procurement  card  administrator  reviews  procurement  card  statements. 


Criteria:  the  standards  we  used  for  our  audit 

The  Institute  should  ensure  procurement  card  purchases  are  supported  by 
appropriate  documentation  and  approved  by  authorized  individuals. 


Policy  does  not 
require  supervisor 
review  and 
approval 


Our  audit  findings 

The  procurement  card  policy  and  the  Institute's  processes  do  not  require 
cardholders'  supervisors  to  review  and  approve  that  procurement  card 
transactions  are  for  valid  business  purposes  and  comply  with  the  Institute's 
policy.  Even  though  the  policy  does  not  require  supervisors  to  approve 
procurement  cards  transactions,  supervisors  reviewed  six  of  1 5  samples  that  we 
reviewed.  Due  to  the  nature  of  procurement  cards  being  open  for  abuse,  we 
believe  the  Institute  should  ensure  supervisors  review  transactions  to  ensure 
they  are  appropriate. 


Two  transactions 
split — against 
policy — to  appear 
to  comply  with 
policy 


We  found  two  instances  where  cardholders  split  a  transaction  greater  than  $750, 
with  the  same  vendor  into  multiple  purchases  contrary  to  the  Institute's  policy. 
Neither  the  supervisors,  nor  the  procurement  card  administrator's  review 
identified  the  transactions  splitting.  The  purchases  were  for  valid  Institute 
expenditures. 


Implication  and  risks  if  recommendation  not  implemented 

Without  an  adequate  process  for  reviewing  and  approving  procurement  card 
statements,  the  Institute  may  pay  for  unauthorized  and  personal  expenditures. 
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2.4  Lakeland  College 

2.4.1     Improve  payroll  controls 
Recommendation 

We  recommend  that  Lakeland  College: 

•  adequately  segregate  stall  access  to  the  PeopleSofl  payroll  system  t<> 
ensure  only  valid  changes  are  made. 

•  review  change  reports  generated  from  the  payroll  system  for 
appropriateness. 

•  prepare  monthly  reconciliations  of  the  payroll  system  to  the  general 
led«er  and  promptly  review  the  reconciliations. 

Background 

Salaries  are  largest         Salaries  and  benefits  are  the  College's  largest  operating  expense.  Its  Human 

Resource  (HR)  department  is  responsible  for  all  HR  functions  and  payroll 
processing. 

Criteria:  the  standards  we  used  for  our  audit 

The  College  should  have  effective  controls  over  payroll  by: 

•  segregating  the  incompatible  functions  of  changing  payroll  data  and 
processing  payroll  information. 

•  generating  reports  of  changes  made  to  payroll  standing  data  from  the 
system  and  reviewing  all  changes  for  appropriateness. 

Our  audit  findings 

The  College  implemented  a  PeopleSoft  payroll  system  in  January  2008.  We 
reviewed  the  data  conversion  process  and  are  satisfied  that  the  College 
accurately  transferred  the  payroll  data  from  the  Ceridian  system  to  the 
PeopleSoft  system. 

However,  all  seven  employees  (including  the  HR  Administrator)  in  the  Human 
Resource  and  payroll  department  have  full  access  to  the  PeopleSoft  payroll 
system.  Their  roles  are  not  adequately  segregated  to  ensure  that  the  College 
only  pays  valid  employees  for  actual  services  prov  ided.  All  seven  employees  in 
the  payroll  department  can: 

•  add  or  remove  employees  from  the  payroll  system. 

•  change  key  employ  ee  information  such  as  rate  of  pay.  benefits  and  banking 
information. 

•  delete  transactions  from  the  PeopleSoft  system,  including  any  evidence  that 
a  transaction  occurred. 
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No  reports 
generated  and  no 
evidence  of 
independent 
review 


No  reports  are  generated  from  the  payroll  system  to  identify  when  changes  have 
been  made  to  employee  information.  There  is  no  evidence  that  changes  to 
employee  information  are  reviewed  by  a  person  who  is  not  involved  in 
processing  payroll. 


Reconciliations 
since  2006  not 
complete 


In  addition,  the  College  had  not  completely  reconciled  payroll  expenses  from 
the  payroll  system  to  the  general  ledger  since  September  2006  to  ensure  that  all 
payments  are  accurately  included  in  the  financial  results.  The  College  should 
complete  and  promptly  review  monthly  reconciliations  to  ensure  all 
transactions  are  accurately  accounted.  This  will  ensure  the  accuracy  of  financial 
information  reported  to  management  and  the  Audit  Committee. 


No  inappropriate 
activity  found 


Despite  the  weaknesses  in  controls,  we  did  not  identify  any  fraudulent  or 
inappropriate  activity  based  on  our  review  of  the  data  file  with  all  transactions 
made  in  the  payroll  system  from  January  1,  2008  to  June  30,  2008. 


Implications  and  risks  if  recommendation  not  implemented 

Inadequate  segregation  of  duties  increases  the  risk  of  fraud  through  payments  to 
fictitious  employees.  The  absence  of  system  generated  change  reports  increases 
the  risk  of  inappropriate  changes  or  errors  going  undetected.  Lack  of 
reconciliations  may  lead  to  unidentified  errors. 

2.4.2     Segregation  of  duties  over  journal  entries 
Recommendation 

We  recommend  that  Lakeland  College  properly  segregate  the  incompatible 
functions  of  preparing  and  approving  journal  entries. 


Use  of  journal 
entries 


Background 

The  College  uses  journal  entries  to  reclassify  items,  correct  errors  or  record 
transactions  not  generated  automatically  by  the  accounting  system.  Journal 
entries  can  also  be  used  to  process  invalid  or  inappropriate  transactions  because 
they  may  circumvent  other  control  processes. 


Criteria:  the  standards  we  used  for  our  audit 

The  College  should  ensure  that  it  has  effective  controls  over  journal  entries  by 
segregating  the  functions  for  preparing  and  approving  the  journal  entry. 
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Our  audit  findings 

Three  indi\  iduals,  including  the  Director  of  I inance.  can  both  enter  and 
approve  an  entry  to  the  general  ledger.  The  Director  entered  and  posted  over 
200  journal  entries  without  involving  another  person  in  the  process.  Despite  the 
control  weakness,  our  testing  of  journal  entries  found  no  inappropriate  entries 
or  entries  lacking  proper  supporting  documentation. 

Implications  and  risks  if  recommendation  not  implemented 

If  the  same  person  can  initiate  and  approve  transactions,  inappropriate  or 
incorrect  entries  may  be  entered,  increasing  the  risk  of  fraud  and  inaccurate 
financial  information. 

2.5  Mount  Royal  College — Segregation  of  payroll  duties 
Recommendation 

W  e  recommend  that  Mount  Royal  C  ollege  adequately  segregate  duties  tor 
processing  payments  to  casual  and  contract  employees. 

Background 

Mount  Royal  College  hires  casual  and  contract  employees  for  its  normal 
operations.  Departments  of  the  College  request  approval  from  Human 
Resources  to  fill  positions.  Payroll  staff  receive  employment  information  forms 
from  departments  to  input  the  information  into  the  payroll  system. 

Criteria:  the  standards  we  used  for  our  audit 

The  College  should  have  effective  controls  over  payroll  by: 

•  segregating  the  incompatible  functions  of  changing  payroll  data  and 
processing  payroll  information. 

•  generating  reports  of  changes  made  to  payroll  standing  data  from  the 
system  and  reviewing  all  changes  for  appropriateness. 

Our  audit  findings 

Payroll  staff  set  up  casual  and  contract  employees  into  the  payroll  system, 
approve  time  sheets  and  authorize  employees  for  payment.  Another  authorized 
individual  does  not  review  and  approve  all  contract  and  casual  employees  who 
have  been  set  up  in  the  payroll  system  to  ensure  they  are  valid  employees  and 
information  is  accurately  entered.  We  did  not  identify  any  fraudulent  or 
inappropriate  activity. 

Implications  and  risks  if  recommendation  not  implemented 

Without  appropriate  segregation  of  duties  w  ithin  the  payroll  system,  payroll 
staff  can  set  up  fictitious  employees,  approve  their  time,  and  process  payments 
to  them. 


Inadequate 
approvals  of 
journal  entries 


Payroll  business 
process  for  casual 
and  contract 
employees 


No  segregation  of 
duties  for  setting 
up  and  paj  ing 
casual  and 
contract 
employees 
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2.6  Bow  Valley  College — Quarterly  financial  reporting 
Recommendation 

We  recommend  that  Bow  Valley  College  improve  its  financial  reporting  to 
the  Board  by: 

•  including — at  least  quarterly — complete  statements  of  financial 
position,  changes  in  net  assets  and  actual  year-to-date  operating 
results. 

•  improving  its  quarterly  processes  and  controls  to  ensure  accurate 
financial  information. 


Quarterly 
financial  reports 
go  to  Board 


Background 

Management  provides  the  Board  with  quarterly  reporting  packages  that  include 
the  statement  of  operations  with  budget  and  forecasted  results,  as  well  as 
variance  information.  An  external  project  manager,  who  manages  the 
construction  of  new  buildings,  also  gives  the  Board  a  monthly  project  status 
report  on  the  construction  activities.  The  Board  also  receives  quarterly 
investment  reports. 


Criteria:  the  standards  we  used  for  our  audit 

The  College  should: 

•  provide  relevant,  complete  and  accurate  information  for  the  Board  to  assess 
the  College's  financial  performance.  Specifically,  the  College  should  give 
the  Board  a  statement  of  financial  position,  operations,  and  changes  in  net 
assets. 

•  have  effective  processes  to  ensure  accurate  financial  information. 


Statement  of 
financial  position 
and  actual 
operating  results 
missing 


Our  audit  findings 

The  College  does  not  provide  the  Board  with  a  complete  statement  of  financial 
position  and  changes  in  net  assets  as  part  of  the  quarterly  financial  statement 
reporting  process.  As  well,  the  statement  of  operations  does  not  include 
year-to-date  actual  results.  This  information  would  give  decision  makers  a  more 
complete  picture  of  the  College's  perfonnance,  financial  position,  activities  and 
resources. 


Not  all  expenses 
and  revenue 
recorded 


The  College  does  not  include  all  material  transactions  in  the  quarterly  reports  to 
the  Board.  For  example,  it  does  not  include  expenditures  for  the  campus 
expansion  that  it  incurred  but  had  not  yet  paid.  In  addition,  it  does  not  record  all 
significant  contract  revenue. 
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Emirs  in  contract 
rc\ cnuc 


The  College  double  counted  about  $l)2.000  of  contract  revenue  at  year-end, 
resulting  in  overstated  contract  revenue.  As  well,  the  College  incorrectly 
recorded  about  $322,000  as  accounts  receivable  even  though  it  had  not  vet 
provided  any  services.  The  College's  review  processes  did  not  identity  this 
error. 


Implications  and  risks  if  recommendation  not  implemented 

W  ithout  improved  financial  reporting  processes,  senior  management  and  the 
Board  may  not  have  relevant  and  accurate  information  to  assess  stewardship  of 
the  College's  resources. 

2.7  Medicine  Hat  College — Periodic  reporting  to  the  Board 
Recommendation 

We  recommend  that  Medicine  Hat  College  improv  e  its  financial  reporting 
to  its  Board  by  including — at  least  quarterly — complete  statements  of 
operations,  financial  position  and  changes  in  net  assets. 


Financial  report 
goes  to  Board 
yearlj 


Background 

The  College  reports  financial  information  to  its  Board  of  Governors  once  a  year 
through  the  "Mid- Year-Review"  and  presentation  of  the  year-end  financial 
statements  for  formal  approval.  The  Mid-Year-Review  includes  a  statement  of 
operations  show  ing  prior-year  actual  revenues  and  expenses,  current-year  base 
budget,  and  the  current-year  amended  budget.  The  document  highlights 
amendments  needed  to  the  current-year  base  budget.  It  also  summarizes  capital 
requests  and  analyzes  the  effects  on  unrestricted  and  restricted  funds.  At 
year-end.  financial  statements  are  prepared  in  accordance  with  generally 
accepted  accounting  principles  and  approved  by  the  Board. 


Criteria:  the  standards  we  used  for  our  audit 

The  College  should: 

•  prov  ide  relevant,  complete  and  accurate  information  for  the  Board  to  assess 
the  College's  financial  performance.  Specifically,  the  College  should  give 
the  Board  a  statement  of  financial  position,  operations,  and  changes  in  net 
assets,  prepared  on  an  accrual  basis. 

•  have  effective  processes  to  ensure  accurate  financial  information. 
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No  quarterly 
reports,  and  actual 
results  to  Audit 
Committee 


Our  audit  findings 

The  College  does  not  provide  quarterly  financial  reports  to  the  Audit 
Committee.  Although  a  mid-year  report  is  prepared  for  the  Board,  it  does  not 
contain  a  complete  statement  of  financial  position  and  changes  in  net  assets  that 
reports  the  actual  results.  As  well,  the  statement  of  operations  does  not  include 
year-to-date  actual  results.  This  information  would  give  decision  makers  a  more 
complete  picture  of  the  College's  performance,  financial  position,  activities  and 
resources. 


Not  all  revenue 
and  expenses 
recorded 


The  College  does  not  include  all  material  transactions  in  the  quarterly  reports  to 
the  Board.  For  example,  it  does  not  include  expenditures  for  constructions  costs 
that  it  incurred  but  had  not  yet  paid,  and  tuition  fees  that  related  to  future 
periods. 


Implications  and  risks  if  recommendation  not  implemented 

Without  improved  financial  reporting  processes,  senior  management  and  the 
Board  may  not  have  relevant  and  accurate  information  to  assess  stewardship  of 
the  College's  resources. 


Payroll  controls 
needed  to  improve 


2.8  Alberta  College  of  Art  and  Design — Payroll  controls — implemented 

In  our  April  2008  Public  Report  (page  182),  we  recommended  that  the  College 
improve  its  payroll  controls  by  properly  segregating  payroll  processing  duties 
and  implementing  controls  for  processing  manual  cheques. 


College  improved 
payroll  controls 


The  College  has  taken  significant  steps  to  improve  the  payroll  control 
environment.  In  October  2007,  management  further  outsourced  the  payroll 
function,  including  the  input  of  payroll  data,  to  Ceridian.  The  College  improved 
processes  and  controls,  including  reviewing  and  approving  payroll  changes, 
payroll-change  documentation,  and  following  its  documentation-retention 
processes.  We  concluded  that  the  payroll  controls  are  adequately  designed  and 
implemented,  and  operated  effectively  from  October  2007  to  June  2008. 


Referred  case  to 
police  for  criminal 
investigation 


Because  of  the  weaknesses  that  previously  existed  in  the  payroll  control 
environment,  an  employee  was  able  to  make  potentially  fraudulent  payments. 
Management  identified  this  and  investigated  the  matter.  It  referred  the  case  to 
the  police  for  a  criminal  investigation. 
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College  improved 
processes  and 
reporting 


Controls  needed 
tor  fuel  purchases 


2.9  Grande  Prairie  Regional  College — Financial  reporting  and  year-end 
processes — implemented 

In  our  21)06  2007  Annual  Report  (No.  20    page  20).  we  recommended  that  the 
College  improve  its  financial  reporting  and  year-end  processes.  W  e  repeated 
this  recommendation  in  our  April  200S  Public  Report  (page  1S3).  The  College 
implemented  the  recommendation  by  providing  financial  statements  to  the 
Executive  Committee  and  Board  quarterly. 

2.10  Portage  College — Fuel  purchases  on  fuel  cards — implemented 

In  our  April  200S  Public  Report  (page  1 X9),  we  recommended  that  Portage 
College  develop  guidelines  and  procedures  Cor  review  and  approval  of  fuel 
purchases  on  fuel-purchase  cards. 


College  switched 
to  procurement 
cards  and 
improved  process 


The  College  stopped  using  fuel-purchase  cards  and  started  using  another  form 
of  procurement  cards.  We  reviewed  the  guidelines  and  procedures  for 
reviewing  and  approving  fuel  purchase  transactions  on  these  procurement  cards. 
We  tested  a  sample  of  purchases  and  found  no  exceptions  to  the  process. 


r 
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3.    Recommendations  to  Universities 

University  of  Alberta — Campus  security  services — implemented 

In  our  2005  2006  Annual  Report  (vol.  2,  page  29),  we  recommended  that  the 
University  of  Alberta  Campus  Security  Section  (CSS)  hire  a  third  party  to 
conduct  an  independent  program  assessment  of  CSS,  including  a  review  of  the 
protocol  agreement  with  the  Edmonton  Police  Serv  ice,  to  ensure  that  CSS 
complies  with  the  law  and  employs  good  enforcement  practices. 

The  University  of  Alberta  implemented  our  recommendation  by: 

•  having  the  Department  of  the  Solicitor  General  and  Public  Security 
conduct  a  review  of  the  Campus  Security  Section.  The  Department  found 
Campus  Security  Section  to  be  in  compliance  w  ith  the  various  statutes  and 
regulations. 

•  entering  into  a  memorandum  of  understanding  with  the  Edmonton  Police 
Service  in  the  fall  of  2008.  This  agreement  addresses  the  working 
relationship  and  responsibilities  between  the  two  parties. 
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Performance  reporting 

Financial  statements 

We  audited  the  financial  statements  for  the  year  ended  June  30,  2008  of  the 
following  entities: 

•  Alberta  College  of  Art  and  Design 

•  Bow  Valley  College 

•  Grande  Prairie  Regional  College  and  its  related  entity  Grande  Prairie  Regional 
College  Foundation 

•  Grant  MacEwan  College  and  its  related  entity  Grant  MacEwan  College 
Foundation 

•  Keyano  College 

•  Lakeland  College 

•  Lethbridge  College  and  its  related  entity  Lethbridge  Community  College  Fund 

•  Medicine  Hat  College  and  its  related  entity  Medicine  Hat  College  Foundation 

•  Mount  Royal  College  and  its  subsidiary/related  entities  Mount  Royal  College 
Day  Care  Society  and  Mount  Royal  College  Foundation 

•  NorQuest  College  and  its  related  entity  NorQuest  College  Foundation 

•  Northern  Alberta  Institute  of  Technology  and  its  related  entities  the  Northern 
Alberta  Institute  of  Technology  Foundation  and  Fairview  College  Foundation 

•  Northern  Lakes  College 

•  Olds  College 

•  Portage  College 

•  Red  Deer  College 

•  Southern  Alberta  Institute  of  Technology 

Unqualified  Our  auditor's  opinions  on  the  financial  statements  for  the  above  entities  were 

auditor's  opinion  unqualified. 

Our  October  2009  Report  will  include  the  results  of  the  financial  statement  audits  of 
the  following  entities  that  have  a  March  3 1,  2009  year  end: 

•  Ministry  of  Advanced  Education  and  Technology 

•  Department  of  Advanced  Education  and  Technology 

•  Access  to  the  Future  Fund 

•  Alberta's  four  Universities 

•  Alberta  Research  Council 

•  iCORE  Inc. 

•  Alberta  Enterprise  Corporation 

•  Alberta  Heritage  Foundation  for  Medical  Research 

•  Alberta  Heritage  Foundation  for  Science  and  Engineering  Research 


To  be  reported  in 
October  2009 
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Education — Review  of  school 
jurisdiction  audit  results 

Our  audit  findings  and  recommendations 

Pursuant  to  section  19(4)  of  the  Auditor  General  Act  we  report  on  our  review  of 
school  jurisdiction  audited  financial  statements  and  management  letters. 

Background 

We  audit  one  of  the  school  jurisdictions  (Northland).  For  those  jurisdictions  w  e 
don't  audit,  we  rev  iew  the  management  letters  sent  to  the  jurisdictions  by  their 
auditors.  Those  audits  were  not  designed  to  assess  all  key  systems  of  control  and 
accountability.  However,  the  auditors  do  report  to  management  about  weaknesses 
that  come  to  their  attention  when  auditing  the  financial  statements.  We  also  review 
the  auditors'  report  on  the  financial  statements. 

There  are  74  school  jurisdictions  comprising  62  school  boards  and  12  charter 
schools. 

Our  audit  findings 

Under  Section  151  of  the  School  Act,  school  jurisdiction  auditors  shall  send 
management  letters,  auditor's  reports  and  audited  financial  statements  to  the 
Minister  by  November  30.  2008.  At  the  time  of  preparing  this  Report,  all  were  sent 
except  three  (Fort  McMurray  Roman  Catholic  Board,  Fort  Mc Murray  School 
District  and  Northland  School  Division).  Consequently,  our  audit  findings  are  based 
on  results  for  71  of  the  74  school  jurisdictions. 

One  qualified         Auditors'  Reports — of  the  71  school  jurisdictions,  one  (Wolf  Creek  School 
audit  opinion         Division)  (not  the  one  reported  in  2007)  received  a  qualified  auditor's  report  for  the 
year  ended  August  3 1 ,  2008.  The  report  was  qualified  because  the  school 
jurisdiction  did  not  write  down  a  significant  account  receivable  to  the  estimated 
recoverable  amount. 

All  other  school  jurisdiction  auditors  reported  that  the  2008  financial  statements 
were  prepared  in  accordance  with  Canadian  generally  accepted  accounting 
principles  (GAAP). 

One  accumulated     Financial  information    of  the  71  school  jurisdictions,  5  (6  in  2007)  school  boards 
operating  deiicit      an(j  3  (2  in  2007)  charter  schools  incurred  annual  operating  deficits.  Annual 
operating  deficits  are  acceptable  to  the  Department  as  long  as  sufficient 
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accumulated  operating  surplus  funds  are  available  to  cover  the  shortfall.  Each  of 
these  jurisdictions  had  sufficient  accumulated  surpluses  to  cover  the  annual 
operating  deficits. 

Accumulated  operating  deficits  are  not  acceptable  to  the  Department.  School 
jurisdictions  with  accumulated  operating  deficits  are  expected  to  work  with  the 
Department  to  eliminate  the  accumulated  operating  deficit  in  accordance  with  a 
Minister  approved  deficit  elimination  plan.  Of  the  71  school  jurisdictions,  one 
(Rocky  View  School  Division)  reported  an  accumulated  operating  deficit  at 
August  31,  2008  amounting  to  $300,000.  The  Department  is  reviewing  the  nature  of 
the  accumulated  operating  deficit  and  is  working  with  the  jurisdiction  to  eliminate 
the  deficit.  The  one  jurisdiction  that  reported  an  accumulated  operating  deficit  at 
August  3 1 ,  2007  has  eliminated  its  deficit. 

The  total  annual  operating  surplus  of  these  71  school  jurisdictions  combined  was 
$138  million  for  the  year  ended  August  31,  2008,  compared  to  $144  million  for 
same  school  jurisdictions  for  the  year  ended  August  3 1 ,  2007. 

Management  letters — the  following  is  a  summary  of  the  audit  findings  and 
recommendations  reported  to  71  school  jurisdictions  by  their  auditors  for  the  year 
ended  August  3 1 ,  2008.  We  have  grouped  our  summary  into  the  following 
categories: 

•  Financial  reporting  and  governance 

•  Internal  control  weaknesses,  and 

•  Information  technology  management 

Users  of  this  summary  should  keep  in  mind  that  the  audits  from  which  these 
findings  came  were  not  designed  to  assess  all  key  systems  of  control  and 
accountability. 

Financial  reporting  and  governance 

a)  Accounting  Issues — 1 1  jurisdictions  (including  1  of  the  9  reported  in  2007) 
need  to  resolve  accounting  issues  relating  to  non-monetary  transactions,  proper 
recording,  reviewing  and  reconciling  of  journal  entries,  recording  revenue  at  a 
gross  amount  and  recording  of  capital  grants  due  but  not  received. 

b)  Board  training — 1  jurisdiction  (none  reported  in  2007)  should  continue  to 
enroll  members  of  the  Board  of  Trustees  in  seminars  and  courses  to  allow  them 
to  further  their  knowledge  in  their  roles  as  board  members  and  to  improve 
financial  literacy. 
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c)  Board  approval   -5  jurisdictions  (including  2  of  the  4  reported  in  2007)  need 
to  ensure  that  board  approv  als  are  obtained  tor  matters  such  as  the  amount  of 
net  assets  to  restrict,  plans  to  spend  excess  school  generated  funds,  board 
minutes  and  superintendent  expenses. 

d)  Budgetary  process— 3  jurisdictions  (including  1  of  the  2  reported  in  2007) 
need  to  improve  their  budgetary  processes. 

e)  Internal  audit    1  jurisdiction  (none  reported  in  2007)  needs  to  consider 
establishing  an  internal  audit  function. 

f)  Review  of  financial  information    14  jurisdictions  (including  6  of  the  16 
reported  in  2007)  need  to  improve  their  review  of  financial  information  such  as 
bank  reconciliations,  journal  entries,  monthly  financial  statements  and 
variances  between  budget  and  actual  expenditures. 

g)  Timeliness  of  financial  recording    2  jurisdictions  (including  I  of  the  N 
reported  in  2007)  need  to  ensure  accounting  transactions,  accruals,  receivable 
statements  or  financial  statements  are  prepared  or  recorded  on  a  regular  and 
timely  basis. 

Internal  control  weaknesses 

a)  Cash  management    1  1  jurisdictions  (including  6  of  the  16  reported  in  2007) 
need  to  improve  cash  management  processes  and  controls. 

b)  Capital  assets — 7  jurisdictions  (including  2  of  the  7  reported  in  2007)  need  to 
improve  the  recording  and  tracking  of  capital  assets. 

c)  Goods  and  Services  Tax — 5  jurisdictions  (none  of  the  3  reported  in  2007) 
need  to  review  their  processes  for  recording  GST  and  remitting  GST  returns. 

d)  Payroll — 1 5  jurisdictions  (including  10  of  the  18  reported  in  2007)  need  to 
improve  controls  over  the  accuracy  of  and  access  to  payroll  information. 

e)  Policies  and  Procedures — 21  jurisdictions  (including  7  of  the  IS  reported  in 
2007)  need  to  update  or  implement  formal  procedures  and  policies. 

0    Purchases    10  jurisdictions  (including  2  of  the  12  reported  in  2007)  need  to 
improve  controls  over  the  purchase  cycle  such  as  the  review  and  authorization 
processes  over  purchases  and  pay  ments,  employee  sign  off  for  goods  received 
and  retention  of  supporting  documentation. 

g)  Segregation  of  duties    9  jurisdictions  (including  1  of  the  7  reported  in  2007) 
need  to  hav  e  segregation  of  duties  over  the  authorization  and  recording  of 
transactions  or  the  custod)  of  and  accounting  for  certain  assets. 

h)  School  generated  funds — 8  school  jurisdictions  (including  2  of  the  9  reported 
in  2007)  need  to  improve  the  processes  used  to  collect,  record,  spend  and  report 
school  generated  funds. 
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Information  technology  management 

Computer  security — 13  jurisdictions  (including  7  of  the  10  reported  in  2007)  need 
to  improve  computer  security  processes  by  having  unique  individual  usernames  and 
passwords,  implementing  a  mandatory  password  change  policy,  backing  up  data  at 
an  offsite  location  and  developing  a  business  continuity  plan  and  a  disaster  recovery 
plan. 

Management  letters  without  recommendations 

For  the  year  ended  August  31 ,  2008,  27  management  letters  issued  to  school 
jurisdictions  did  not  contain  recommendations.  This  compares  to  20  for  the  year 
ended  August  31,  2007. 

Department's  actions 

The  Department  contacts  all  jurisdictions  and  encourages  them  to  deal  with  the 
issues  raised  in  the  management  letters,  particularly  noting  recommendations 
repeated  from  prior  years. 
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Alberta  Capital  Finance  Authority 

Summary  of  our  recommendation 

Additional  skilled  resources  required 
Recommendation 

We  recommend  that  management  of  Alberta  Capital  Finance  Authority  secure 
additional  skilled  resources  to  help  implement  new  required  financial 
accounting  standards  and  to  ensure  the  cost-effective  preparation  and 
management  review  of  its  annual  financial  statements. 


Background 

Authority  finances    The  Alberta  Capital  Finance  Authority  is  an  agent  of  the  Alberta  government.  It 

capital  projects  tor    provides  financing  for  capital  projects  to  local  entities.  The  Authority  can  borrow  in 

oca  entities  a        capital  markets  at  low  er  rates,  not  available  to  local  authorities  actinu 
lower  rates  h 

independently.  It  makes  loans  to  Alberta  municipalities,  school  boards  and  other 

local  entities  at  interest  rates  based  on  the  cost  of  its  borrow  ing.  The  Authority 

Authority  uses  provides  fixed-rate  loans  to  its  borrowers,  but  may  borrow  at  fixed  or  floating  rates, 

derivatives  to  r 

reduce  It  uses  interest  rate  swaps  (derivatives)  to  convert  debt  to  fixed  rates  to  reduce 

interest-rate  risk  interest-rate  risk. 


Complex  new 
accounting 
standards  require 
more  time  to 
implement  and 
maintain 


Authority  maj 
need  to  develop 
and  test  new 
processes 


As  a  government  business-type  organization,  the  Authority  follow  s  the  accounting 
standards  of  the  Canadian  Institute  of  Chartered  Accountants  Handbook.  The  extent 
of  disclosure  required  in  the  annual  financial  statements  has  increased  substantially 
since  2007  when  financial  instruments  standards  were  implemented.  The  standards 
require  loans  and  debt  to  be  recorded  at  fair  value  and  extensive  disclosures  for 
derivative  financial  instruments.  Additional  disclosures  were  required  in  2008,  and 
further  changes  are  expected  in  2009.  The  new  standards  are  complex  and  require 
significant  time  and  effort  to  implement  and  maintain.  The  information  for  some  of 
the  new  requirements  may  not  be  readily  available  from  existing  systems.  The 
Authority  may  need  to  dev  elop  and  test  processes  to  ensure  that  the  financial 
statements  are  accurate  and  include  all  disclosures  required  by  Canadian  generally 
accepted  accounting  principles  (GAAP). 


Criteria:  the  standards  we  used  for  our  audit 

The  Authority  should: 

•     have  sufficient  skilled  resources  to  prepare  its  annual  financial  statements  in 
accordance  with  Canadian  GAAP.  This  includes  ensuring  that  the  amounts 
reported  in  the  financial  statements  are  accurate,  that  all  required  disclosures  are 
included,  and  that  a  management  review  of  the  financial  statements  is 
performed. 
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make  its  draft  financial  statements  and  notes  available  to  the  auditors  at  the  start 
of  the  audit  and  ensure  they  contain  few,  if  any,  omissions  of  required 
disclosures. 


Authority  needs 
more  resources  to 
meet  new 
standards 


Our  audit  findings 

The  financial  close-and-reporting  process  for  the  Authority  has  become  increasingly 
complex  due  to  the  use  of  derivatives  and  the  adoption  of  new  complex  accounting 
standards;  however,  the  resources  available  to  support  the  research  and 
interpretation  of  new  standards  and  prepare  the  financial  statements  has  not 
increased  accordingly. 


Auditor  had  to 
help  management 
meet  standards 


In  the  absence  of  sufficient  resources  with  knowledge  of  the  complex  financial 
accounting  standards,  the  auditors  have  had  to  assist  management  with  financial 
reporting,  a  responsibility  which,  over  time,  could  possibly  compromise  the 
auditors'  objectivity.  Further,  the  true  cost  of  the  audit  is  not  properly  reflected. 


Implications  and  risks  if  recommendation  not  implemented 

The  risk  of  misstatement  due  to  error  in  applying  accounting  standards,  in 
calculations,  or  in  omitting  required  material  disclosures  increases  if  management 
does  not  have  sufficient  and  appropriately  skilled  resources  to  prepare  and  review 
financial  statements.  Misstated  financial  statements  could  cause  the  users  of  the 
financial  statements  to  make  incorrect  decisions. 
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Outstanding  recommendations 

This  is  a  complete  list  of  numbered  and  unnumbered  recommendations  that  are  not  yet  implemented. 
Although  management  may  consider  some  of  these  recommendations  implemented,  we  do  not  remo\e 
recommendations  from  the  list  until  we  have  been  able  to  complete  follow-up  audit  work  to  confirm 
implementation.  The  number  of  outstanding  recommendations  older  than  three  years  is  on  page  123. 


Auditee 

Original 
Recommendation 

Repeated 

Recommendation  subject 

Cross-Ministry 

Executive  Council 

2(104  05 

#1  &#2.  p.  28 

Recruiting,  evaluating  and  training  boards  of 
directors 

Executive  Council 

October  2008 
#1,  p.  27 

CEO  selection,  evaluation  and 
compensation:  Guidance 

Executive  Council  (Agency 
Governance  Secretariat) 

October  2008 
#2.  p.  29 

CEO  selection,  evaluation  and 
compensation:  Accountability 

Service  Alberta 

2005-06 

#22,  vol.  1.  p.  174 

IT  Project  Management 

Treasury  Board 

2006-07 

#17,  vol.  l.p.  174 

Government  credit  cards 

Also  see  Recommendations  to  more  than  one  ministry — page  120 

Aboriginal  Relations 

2006-07 
vol.  2,  p.  124 

Grant  monitoring 

Also  see  Recommendations  to  more  than  one  ministry — page  120 

Advanced  Education  and  Technology 

April  2008 
#l,p.  22 

Post-Secondary  Institutions — non-credit 
programs:  Clarify  standards  and  expectations 

April  2008 
#2,  p.  23 

Post-Secondary  Institutions — non-credit 
programs:  Monitor  Institutions'  non-credit 
programs 

April  2008 
#8,  p.  195 

College  and  technical  institute  computer 
controls:  Well-designed  and  effective  IT 
control  policies  and  processes 

All  Universities 

October  2008 
#23.  p.  232 

Review  accounting  treatment  for  Universities 
Academic  Pension  Plan  for  all  universities 

Alberta  College  of  Art  and 
Design 

2006-07 
vol.2,  p.  21 

IT  internal  controls 

Alberta  College  of  Art  and 
Design 

April  2008.  p.  180 

ACAD — Financial  reporting  and  year-end 
processes 

Grande  Prairie  Regional 
College 

April  2008.  p.  184 

Capital  asset  management 

Grant  MacEwan  College 

2004-05.  p.  104 

Computer  control  environment 

Grant  MacEwan  College 

November  2006 
#9,  p.  35 

Post  Secondary  Institutions:  Grant  MacEwan 
College  construction  management 

Grant  MacEwan  College 

November  2006 
#10.  p.  37 

Post  Secondary  Institutions:  Donations  to 
Grant  MacEwan  College 
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Auditee 

Original 
Recommendation 

Repeated 

Recommendation  subject 

r~fmtit  lVtapPwan  (^nllpcxp 

V_I  Id  III   lVldV_Wdll  V  KJ  I  It  _, W 

Anril  7008 

AUI  11  —  \r\J  O 

p.  186 

flnnt  IV! ?ipP w/fin  f^ol  Ipctp  Rook  <;torp 

VJldlll  lVldv^l_Wdll  V^vJllt&V         1_JL/VJI\.3  WJL  V 

onprations 

V  '  1  /  V  1  d  1 1 V 1 1 13 

Mount  Royal  College 

2004-05,  p.  100 

Retention  and  severance  agreements 

IVInunt  Rnval  f^nllpcrp 

lVlv/LHIL  IWjydl  V_  Ullttv 

9004-05  n  101 

_V/W"     V/.J ,  LJ.    1  \J  1 

(~ir\\/f*irrmr\c'fi  ;irirl  Human  Rp^onrvps 

V  J  U  V  tl  1  1  ill  1 L  L   dl  IvJ   1  1  LI  1 1  Idl  1   I  v  Ve>     Lll  V  VO 

Committee  Charter 

"North  pm  A  Ihprt^i  Institntp 

1  N  V.7I  11 1 VI  1 1  /ilL^Vlld   1 1 1 0  1 1  L  LI  IV 

of  Technology 

Anril  ^008  n  48 

/VL/111  _  V  '  V  /  (  » ,   LJ.  i(i 

NAIT — porwtniption  manaopmpnt  nroppssps* 

i  >  r\ i  i       v-i/i  i_*ii  uv-ni'i  i  1 1  idi  i  ti  i_.vi  i  lvi  i  l  L/i  \j  ^vsaca . 

selection  processes 

I  f n i vpr<2i tv  of  Alhprtfi 

2003-04  n  252 

^ttratpenf*  nlannino  for  Rpspurph 

i_ tl  dlt fci,  1 v  yJ idl il  1 11 1      1  \Jl  lVvSCul  ii 

T  Inivpr*iitv  nt  Alhprt.i 

I^J  1 1 1  V       o  1 I  V   \J  1  iVIL'^llcl 

2006-07 
vol.  2,  p.  24 

Qppiiritv  pnn ti CTi lrati on  spttino"S 
k  uii  i  l  y  cunt  i  Lui  ill  n  m  i  >l  1 1  n  i 

I  Imvpr^itv  of  A  Ihprta 

October  ~>008 
#20,  p.  211 

Imnrovp  invpitmpnt  controls 

HIIL/IV'VV    lllVVollllVlll  VV11LIVJ1_ 

I  tnivpr^itv  of  f^aloarv 

Ulll  vci  oily      l  v^-tlli^cll  y 

2003-04 
#26,  p.  255 

Plfinnino  for  rpspnrph  panapitv 

1  ICtlllllllw  1VJ1   lve5V-dlv.il  vflUuvlly 

University  of  Calgary 

2003-04,  p.  254 

Research  measures  and  targets 

University  of  Calgary 

2003-04,  p.  257 

2006-07 
vol.  2,  p.  15 

Controls  over  sponsored  research  and  trust 
accounts 

University  of  Calgary 

2004-05 
#18,  p.  90 

Research  roles  and  responsibilities 

University  of  Calgary 

2004-05,  p.  91 

Research  policies 

University  of  Calgary 

2004-05,  p.  92 

Research  project  proposals 

University  of  Calgary 

2004-05,  p.  93 

Research  project  management 

University  of  Calgary 

2004-05,  p.  94 

Accounting  for  research  revenues  and 
expenditures 

University  of  Calgary 

2005-06 
vol.  2,  p.  20 

General  computer  controls 

University  of  Calgary 

2005-06 
vol.  2,  p.  24 

•  2006-07 
vol  2  d  13 

•  October  2008 
#22,  p.  219 

PeopleSoft  security 

University  of  Calgary 

2006-07 

#18  vol  1  d  10 

Information  technology  (IT)  governance  and 

control  framework 

\.  V  '  1111  \_r  1    lltllllV'VV  \J  1  Iv 

University  of  Calgary 

2006-07 
vol  2  d  12 

October  2008 
D  916 

Controls  over  payroll 

University  of  Calgary 

October  2008 
#21,  p.  213 

Improving  the  University's  decentralized 
control  environment 

V  \  >  I  111  V   '  1     VI  I  V   1  1  V  /  1  111  IV1  1  I 

University  of  Calgary 

October  2008 
p.  217 

Improving  controls  over  journal  entries 

University  of  Calgary 

October  2008 
d  221 

Improving  controls  over  investments 

University  of  Calgary 

October  2008 
p.  222 

Complying  with  legislation 

University  of  Lethbridge 

2006-07 

#21,  vol.  2,  p.  23 

IT  internal  control  framework 

University  of  Lethbridge 

October  2008 
p.  223 

Improving  the  University's  financial 
processes 

University  of  Lethbridge 

October  2008 
p.  225 

Clearly  defined  financial  research  roles  and 
responsibilities 

University  of  Lethbridge 

October  2008 
p.  227 

Clear  and  complete  research  policies 
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Past  recommendations 


Auditee 

Original 
Recommendation 

Repeated 

Recommendation  subject 

University  of  Lethbridge 

October  200S 
p.  231 

Changed 

circumstance  see 
page  26 

Periodic  reporting  to  the  Hoard  of  Governors 
on  financial  risks. 

Also  see  Recommendations  to  more  than  one  ministry — page  120 

Agriculture  and  Rural  Development 

2000-01,  #3.  p.  50 

2004  0> 
#20,  p.  113 

F\aluating  program  success:  grant 
management 

2002  03.  #3,  p.  49 

Performance  measurement 

2003-04.  #3.  p.  80 

BSE  Report  July  2004:  Risk  assessment  for 
the  agriculture  and  agri-food  industry  in 
Alberta 

2005-06 
vol.  2,  p.  39 

Verifying  eligibility  for  the  Canada-Alberta 
Fed  Cattle  Set  Aside  program 

2005-06 
vol.  2.  p.  40 

Developing  and  monitoring  compliance  with 
an  information  technology  security  policy 

2005-06 

#24.  vol.  2.  p.  37 

Verifying  eligibility  for  Farm  Fuel  Benefit 
program 

November  2006 
•••12.  p.  46 

Expense  Accounts:  Processes  for  reporting 
and  dealing  with  allegations  of  employee 
misconduct 

Agriculture  Financial 
Serv  ices  Corporation 

2006-07 
vol.  2.  p.  32 

Loan  loss  allowance  methodology  and 
process 

Agriculture  Financial 
Services  Corporation 

2006-07 
vol.  2.  p.  34 

Wireless  technology 

Also  see  Recommendations  to  more  than  one  ministry — page  120 

Children  and  Youth  Services 

2001-02.  #8.  p.  53 

2002-03.  p.  69 

Contract  Management  Systems 

2001-02.  #9.  p.  54 

Risk  assessment  and  internal  audit  serv  ices 

2006-07 

#6.  vol.  l.p.  79 

Child  intervention  services:  Enhanced  child 
interv  ention  standards 

2006-07 

#7,  vol.  l.p.  82 

Child  interv  ention  services:  Accreditation 
systems  for  serv  ice  prov  iders 

2006-07 

#8,  vol.  l.p.  83 

Child  intervention  services:  Department 
compliance  monitoring 

Child  and  Family  Services 
Authorities 

2006-07 
vol.  l.p.  86 

Child  intervention  services:  Authorities 
compliance  monitoring  processes 

Child  and  Family  Services 
Authorities 

2006-07 
vol.1,  p.  88 

Child  intervention  services:  Authorities 
monitoritm  of  serv  ice  prov  iders 

Culture  and  Community  Spirit 

Also  see  Recommendations  to  more  than  one  ministry — page  120 

Education 

2004-05 
#27,  p.  157 

2006-07 

#22,  vol.  2.  p.  46 

(Purchase  of  textbooks)  Savings  generated 
by  Learning  Resources  Centre 

2005-06 

#25,  vol.  2,  p.  65 

School  board  budget  process 
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Past  recommendations 


Outstanding  recommendations 


Auditee 

Original 
Recommendation 

Repeated 

Recommendation  subject 

2005-06 

#26,  vol.  2,  p.  68 

School  board  interim  reporting — minimum 
standards  and  best  practices 

2006-07 
vol.  2,  p.  45 

Business  cases 

Employment  and  Immigration 

2006-07 

VOl.  Z,  p.  JJ 

Income  support  program — exception  reports 

2006-07 
vol.  2,  p.  56 

Compliance  audit  function — Income  support 
program 

2006-07 
vol.  2,  p.  57 

Debit  cards 

2006-07 
vol.  2,  p.  58 

Capital  asset  policy 

2006-07 

#23,  vol.  2,  p.  60 

Information  technology  control  environment 

October  2008 
#24,  p.  245 

Monitoring  and  enforcement  of  training 
providers 

October  2008 
p.  249 

Approving  and  renewing  training  programs 

October  2008 
p.  251 

Improving  the  use  of  information  systems 

Workers'  Compensation 
Board 

October  2008 
p.  253 

Enforce  procedures  and  guidelines  for 
purchasing-card  program 

Also  see  Recommendations  to  more  than  one  ministry — page  120 

Energy 

2003-04 
#10,  p.  125 

Oil  sands  projects  approvals — incorporating 
risk  into  project  assessment 

2004-05 
#28,  p.  165 

2005-06 
#27,  vol.  2,  p.  76 

Assurance  on  well  and  production  data 

2006-07 

#9,  vol.  l,p.  115 

Energy's  royalty  review  systems:  Royalty 
regime  objectives  and  targets 

2006-07 

#10,  vol.  l,p.  119 

Energy's  royalty  review  systems:  Planning, 
coverage,  and  internal  reporting 

2006-07 

#11,  vol.  l,p.  124 

Energy's  royalty  review  systems:  Improving 
annual  performance  measures 

2006-07 

#12,  vol.  1,  p.  126 

Energy's  royalty  review  systems:  Periodic 
public  information 

2006-07 

#13,  vol.  l,p.  129 

Energy's  royalty  review  systems:  Enhancing 
controls 

April  2008,  p.  57 

Department  of  Energy's  system  for 
identifying  and  managing  conflicts  of 
interest:  Documenting  potential  conflicts  of 
interest 

October  2008 
#25,  p. 255 

Alberta's  Bioenergy  Programs 

October  2008 
#26,  p.  257 

Strengthen  controls  to  detect  and  prevent 
errors  in  reporting  of  royalty-liable  fuel-gas 
volumes 

FteporUrf  the  Auditor  General  of  Alberta 
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Past  recommendations 


Outstanding  recommendations 


Auditee 

Original 
Recommendation 

Repeated 

Recommendation  subject 

Energ\  Resources 
Conservation  Board 

2004-05 
#29,  p.  169 

Assurance  systems  for  \olumctric  aceurac) 

1  ncrg\  Resources 
Conservation  Board 

2004-05 
#30.  p.  173 

Liability  management  tor  suspension, 
abandonment  and  reclamation  activities 

Energ\  Resources 
Conserv  at  ion  Board 

2006-07 

#24,  vol.2,  p.  71 

IT  control  framework 

Also  see  Recommendations  to  more  than  one  ministry    page  120 

Environment 

|Oc),s  go 
#30.  p.  1 58 

•  'Ml  III  ()| 

#8,  p.  90 

•  2004-05 

#31, p.  180 

Financial  securitv  tor  land  disturbances 

2002-03 
#12.  p.  103 

">00S  -06 

#29,  vol.  2,  p.  87 

(  Milium i  n:itt*(  1  sitt's  m  innivil  it  >n  svsh'tiis 

2005-06 

#1,  vol.  1.  p.  37 

Drinkim*  W  ;iti*t"  A nnnu  :ik  'inii  tvinsTnl mils 

->nns  06 

v/ V/  _/ \J\J 

#2,  vol.  l,p.43 

l^rinkino  \\  * ;  1 1  *  *  i*  *  1  nsntM't  inn  *s\.slt*m 

2005  06 

-■4.  \ol.  1.  p.  52 

l^rmkmo  W " ; 1 1 * » i"  1  n 1 1 Arnvi  1  mn  svstiMiis 

2005-06 

#5,  vol.  l.p.  53 

Drinking  Water:  Supporting  Environment's 
drinking  water  goals 

2005-06 
vol.  l.p.  48 

Drinking  Water:  Communicating  with 
partners 

2005-06 

#28,  vol.  2.  p.  84 

Water  Well  Drilling 

October  2008 
#9.  p.  97 

Alberta's  response  to  climate  change: 
Planning 

October  2008 
#10.  p.  100 

Alberta's  response  to  climate  change: 
Monitoring  processes 

October  2008 
#11.  p.  101 

Alberta's  response  to  climate  change:  Public 
reporting 

October  2008 
#27,  p.  261 

Climate-Change  and  I- missions- Management 
Fund 

October  2008 
p.  262 

EcoTrust  governance 

Also  see  Recommendations  to  more  than  one  ministry — page  120 

Executive  Council 

See  Cross-Ministry — page  107 

Finance  and  Enterprise 

2005-06 

#30a.  vol.  2,  p.  97 

Supplementary  Retirement  Plans — assess  the 
annual  and  cumulative  costs  and  risks 

2006-07 
vol.  2,  p.  85 

Alberta  Indian  Tax  Exemption  program 
limits 

2006-07 
vol.  1.  p.  142 

The  Government's  revenue  forecasting 
systems:  Rates  of  return  used  to  forecast 
investment  income 
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Past  recommendations 


Outstanding  recommendations 


Auditee 

Original 
Recommendation 

Repeated 

Recommendation  subject 

2006-07 
vol.  l,p.  143 

The  Government's  revenue  forecasting 
systems:  Personal  income  tax  forecast 

2006-07 

#14,  vol.  l,p.  145 

The  Government's  revenue  forecasting 
systems:  Corporate  income  tax  forecast 

2006-07 

#16,  vol.  l,p.  149 

The  Government's  revenue  forecasting 
systems:  Public  reporting  of  revenue 
forecasts 

2006-07 
vol.  2,  p.  87 

Obtaining  assurance  on  third  party  service 
providers 

October  2008 
#28,  p.  268 

Financial  reporting  processes  and  succession 
planning — Investment  Accounting  and 
Reporting  Group 

October  2008 
p.  270 

Donated  funds — Alberta  Heritage 
Scholarship  Fund 

October  2008 
p.  271 

Payroll  bank  reconciliations 

October  2008 
p.  272 

User  access 

October  2008 
p.  273 

Use  of  spreadsheets  in  processing  taxes 

AIMCo 

2006-07 

#25,  vol.  2,  p.  91 

Controls  over  derivative  contracts 

AIMCo 

2006-07 
vol.  2,  p.  92 

October  2008 
#33,  p.  287 

Ensuring  completeness  and  accuracy  of 
private  equity  partnership  investments 

AIMCo 

2006-07 
vol.  2,  p.  93 

Access  and  change  management  controls 

AIMCo 

October  2008 
#32,  p.  279 

Internal  control  certification 

AIMCo 

October  2008 
p.  284 

Conflicting  responsibilities  for  internal  audit 

AIMCo 

October  2008 
p.  285 

Procedures  for  valuing  real  estate 
investments 

AIMCo 

October  2008 
#34,  p.  288 

International  Swaps  and  Derivatives 
Association  Agreements 

AIMCo 

October  2008 
p.  290 

Controls  over  trading  with  approved 
counterparties 

AIMCo 

October  2008 
p.  291 

Performance  measurement  review  processes 

AIMCo 

October  2008 
p.  291 

Controls  over  records  management 

Alberta  Capital  Finance 
Authority 

October  2008 
p.  292 

Alberta  Capital  Finance  Authority- 
Deadlines  to  finalize  financial  statements, 
finish  the  audit,  and  schedule  the  Audit 
Committee  meeting 

Alberta  Securities 
Commission 

October  2008 
p.  294 

Purchase  policy 
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Past  recommendations 


Outstanding  recommendations 


Auditee 

Original 
Recommendation 

Repeated 

Recommendation  subject 

ATB 

1 999-00 
#49.  p.  281 

•  2000-01 
#49.  p.  258 

•  2001  02 
#17,  p.  103 

•  2003  04 
#18.  p.  161 

•  2004-05 
#33,  p.  195 

Strengthening  internal  controls  branch 
operations 

ATB 

2001-02 
#16,  p.  101 

2002-03 
#16,  p.  121 

Risk  management 

ATB 

2002-03 
#15.  p.  119 

•  2003-04 
#17,  p.  159 

•  2004  05 
#32,  p.  193 

Lending  policy  compliance 

ATB 

2006-07 

#26.  vol.  2.  p.  94 

Processes  to  confirm  compliance  with 
Alberta  Finance  Guideline 

ATB 

2006-07 
vol.  2.  p.  97 

Information  technology  control  framework 

ATB 

2006-07 
vol.  2.  p.  99 

General  loan  loss  allowance 

ATB 

October  2008 
p.  274 

Internal  controls  over  fair-value  calculations 
of  investments  and  derivatives 

ATB 

October  2008 
p.  276 

Derivative  credit  limits  in  report 

ATB 

October  2008 
p.  277 

Controls  for  capturing  non-consumer  loan- 
risk  ratings  in  its  banking  system 

ATB 

October  2008 
#29.  p.  278 

Action  plans  to  resolve  internal  control 
weaknesses  identified  by  ATB*s  internal 
control  group 

ATB 

October  2008 
#30.  p.  279 

Criminal-record  checks 

ATB 

October  2008 
#31,  p.  280 

Securitization  policy  and  business  rules 

ATB 

October  2008 
#12.  p.  118 

ATB  Financial — treasury  management: 
Business  rules  and  operating  procedures 

ATB 

October  2008 
p.  123 

ATB  Financial — treasury  management: 
Performance  targets 

ATB 

October  2008 
p.  125 

ATB  Financial — treasury  management: 
Variable  pa\  program 

ATB 

October  2008 
p.  127 

ATB  Financial — treasury  management: 
Liquiditv  reporting 

ATB 

October  2008 
p.  128 

ATB  Financial — treasury  management: 
Liquidity  simulations 

ATB 

October  2008 
#13.  p.  129 

ATB  Financial — treasury  management: 
Liquidity  contingency  plan 

ATB 

October  2008 
#14,  p.  131 

ATB  Financial — treasury  management: 
Interest  rate  risk  reporting 

ATB 

October  2008 
p.  132 

ATB  Financial — treasury  management: 
Interest  rate  risk  model  assumptions 

ATB 

October  2008 
p.  134 

ATB  Financial — treasury  management: 
Interest  rate  risk  modeling  and  stress  testing 
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Past  recommendations 


Outstanding  recommendations 


Auditee 

Original 
Recommendation 

Repeated 

Recommendation  subject 

ATB 

October  2008 
p.  136 

ATB  Financial — treasury  management: 
Interest  rate  risk  controls 

ATB 

October  2008 
p.  137 

ATB  Financial — treasury  management:  Role 
and  use  of  middle  office 

ATB 

October  2008 
p.  138 

ATB  Financial — treasury  management: 
Treasury  infonnation  systems 

ATB 

October  2008 
p.  139 

ATB  Financial — treasury  management: 
Treasury  policies 

ATB 

October  2008 
#15,  p.  142 

ATB  Financial — treasury  management:  Role 
of  ALCO 

ATB 

October  2008 
p.  143 

ATB  Financial — treasury  management: 
Internal  audit  program 

Also  see  Recommendations  to  more  than  one  ministry — page  120 

Health  and  Wellness 

Department 

1 997-98 
#27,  p.  125 

•  1999-00 
#21,  p.  144 

•  2005-06 
#19,  vol.  1, 
p.  153 

Population-based  funding:  Data 
improvement 

1998-99 
#19,  p.  93 

1999-00 
#39,  p.  238 

Academic  Health:  Governance  and 
accountability 

2000-01 
#17,  p.  121 

2005-06 

#33,  vol.  2,  p.  120 

Analysis  of  physician  billing  information 

2001-02 
#24,  p.  135 

•  2003-04 
#22,  p.  195 

•  2005-06 
#34,  vol.  2, 
p.  123 

Information  technology  control  environment 

2001-02,  p.  134 

2002-03 
#22,  p.  152 

Control  of,  and  accountability  for,  restricted 
funding 

2002-03,  #23,  and 
p.  156  and  157 

Province  Wide  Services 

2003-04 
#23,  p.  197 

Accountability  of  the  Health  Regions  to  the 
Minister  of  Health  and  Wellness 

2005-06 

#17,  vol.  l,p.  146 

RHA  Global  Funding:  Defining  goals  and 
performance  measures 

2005-06 
vol.  1,  p.  147 

RHA  Global  Funding:  Periodic  analysis 

2005-06 

#18,  vol.  l,p.  149 

RHA  Global  Funding:  Non-formula  funding 
adjustments 

2005-06 

#20,  vol.  l,p.  155 

RHA  Global  Funding:  Funding 
communications 

2005-06 

#21,  vol.  l,p.  156 

RHA  Global  Funding:  Coordination  of 
capital  and  operating  decisions 

2005-06 
vol.  l,p.  158 

RHA  Global  Funding:  Documentation 
retention 

2005-06 
vol.  1,  p.  159 

RHA  Global  Funding:  Data  availability  and 
timeliness 
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Past  recommendations 


Outstanding  recommendations 


Auditee 

OrininPil 

Recommendation 

Repeated 

Recommendation  subject 

2005-06 

RH A  Global  Funding:  ResoK  ing  Global 

vol.  1,  p.  160 

Funding  issues 

2005-06 

2i>05  Ministry  annual  report  results 

#31,  vol.  2.  p.  116 

analysis 

2005-06 

2005  Ministrv  annual  report  performance 

#32.  vol.  2.  p.  1  IS 

measures 

2006-07 

Unauthorized  network  connections 

vol.  2.  p.  105 

2006-07 

Claims  assessment  system 

vol.  2.  p.  107 

April  2008 

Implementing  the  Provincial  Mental  Health 

#4.  p.  77 

Plan:  The  accountability  framework 

October  2008 

Compliance  monitoring  activities 

#35.  p.  300 

October  2008 

Infrastructure  funding  for  health  facilities 

p.  301 

October  2008 

Province  Wide  Sen  ices 

#36.  p.  303 

Health  and  Wellness  and 

October  2008 

Alberta's  mental  health  deli\ery  system: 

Alberta  Health  Serviees 

#16.  p.  162 

Mental  health  standards 

Health  and  Wellness  and 

October  2008 

Alberta's  mental  health  delivery  system: 

Alberta  Health  Services 

p.  186 

Funding,  planning,  and  reporting 

Health  and  Wellness  and 

October  2008 

Alberta's  mental  health  delivery  system: 

Alberta  Health  Sen  ices 

p.  190 

Aboriginal  and  suicide  priorities 

Department  and  Alberta 

April  2008 

Implementing  the  ProGncial  Mental  Health 

Mental  Health  Board 

#3.  p.  72 

Plan:  Implementation  systems 

Alberta  Health  Services 

October  2008 

Alberta's  mental  health  delivery  system: 

(AHS) 

#17.  p.  164 

Housing  and  supportive  livinu 

Alberta  Health  Services 

October  2008 
#18.  p.  168 

Alberta's  mental  health  delivery  system: 
Clients  with  concurrent  disorders 

Alberta  Health  Services 

October  2008 
p.  169 

Alberta's  mental  health  deli\er\  svstem: 
Relationships  with  not-for-profit 
organizations 

Alberta  Health  Services 

October  2008 
#19,  p.  171 

Alberta's  mental  health  delivery  system: 
Opportunities  to  reduce  eaps  in  sen  ice 

Alberta  Health  Serv  ices 

October  2008 
p.  176 

Alberta's  mental  health  delivery  system: 
Provincial  coordination 

Alberta  Health  Services 

October  2008 
p.  181 

Alberta's  mental  health  delivery  system: 
Improving  community-based  service 
delivery 

AHS— Alberta  Alcohol 

November  2006 

Contracting  Practices:  Internal  controls 

and  Drug  Abuse 

#1,  p.  14 

Commission 

AHS— Alberta  Alcohol 

November  2006 

Contracting  Practices:  Board  governance 

and  Drug  Abuse 

#3,  p.  17 

Commission 

AHS— Alberta  Alcohol 

2006-07 

General  computer  controls 

and  Drug  Abuse 

vol.  2.  p.  1 16 

Commission 

AHS — Alberta  Cancer 

2006-07 

Controls  over  access  to  computer 

Board 

vol.2,  p.  115 

applications 
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Past  recommendations 


Outstanding  recommendations 


Audi  tee 

Original 
Recommendation 

Repeated 

Recommendation  subject 

AHS— Calgary  Health 
Region 

2005-06 

#36,  vol.  2,  p.  128 

Monitoring  service  provider  compliance  and 
performance 

AHS— Calgary  Health 
Region 

2006-07 

#28,  vol.  2,  p.  1  12 

Change-management  process 

AHS— Calgary  Health 
Region 

2006-07 

#29,  vol.  2,  p.  113 

Inappropriate  user  access 

AHS    Calgary  Health 
Region 

October  2008 
p.  306 

Information  technology  change  management 
controls 

AHS— Calgary  Health 
Region 

October  2008 
p.  307 

Information  technology  user  access 
management  controls 

AHS— Capital  Health 
Authority  and  Calgary 
Health  Region 

2000-01 
p.  135 

Performance  measures  for  surgical  services 

AHS— Capital  Health 

October  2008 
p.  308 

Information  technology  security  controls 

AHS— Capital  Health 

October  2008 
p.  309 

Information  technology  change  management 
controls 

AHS — Peace  Country 
Health 

October  2008 
p.  311 

Expense  claims  and  corporate  credit  cards 
controls 

AHS — Peace  Country 
Health 

October  2008 
p.  312 

Contract  documentation 

AHS — Peace  Country 
Health 

October  2008 
p.  313 

Information  technology  user  access 

Health  Quality  Council  of 
Alberta  (HQCA) 

October  2008 
p.  317 

Investigative  Role  Policy 

HQCA 

October  2008 
p.  319 

Guidance  on  using  legal  assistance 

Also  see  Recommendations  to  more  than  one  ministry — page  120 

Housing  and  Urban  Affairs 

October  2008 
p.  336 

Affordable  housing  advances 

Also  see  Recommendations  to  more  than  one  ministry — page  120 

Infrastructure 

Also  see  Recommendations  to  more  than  one  ministry — page  120 

International  and  Intergovernmental  Relations 

October  2008 
p.  324 

Evaluating  international  offices' 
performance 

October  2008 
p.  326 

Ensuring  effective  information-system 
controls 

Also  see  Recommendations  to  more  than  one  ministry — page  120 

Justice  and  Attorney  General 

2006-07 

#31,  vol.  2,  p.  128 

Information  Technology  Security 

2006-07 
vol.  2,  p.  129 

Disaster  Recovery  Plans 
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Past  recommendations 


Outstanding  recommendations 


Auditee 

Original 
Recommendation 

Repeated 

Recommendation  subject 

2006-07 
vol.  2.  p.  130 

Information  Technology  Access  (  ontrols 

2006-07 
vol.  2.  p.  131 

Judicial  Information  Technology  Security 

Office  of  the  Public 
Trustee.  Estates  and  Trusts 

October  2008 
p.  331 

Administrate  Policy  Changes 

Also  see  Recommendations  to  more  than  one  ministry — page  120 

Legislative  Assembly 

2006-07 
vol.  2.  p.  189 

Strengthen  policies  for  Members'  Services 
Allowance 

2006-07 
vol.  2.  p.  192 

Temporary  Residence  Allowance 

Also  see  Recommendations  to  more  than  one  ministry — page  120 

Municipal  Affairs 

2001-02 
#46.  p.  220 

Changed 

circumstances — see 
page  47 

Emergency  preparedness 

2003-04.  p.  265 

2006-07 
Vol.  2.  p.  138 

Information  Technology  management 
controls 

October  2008 
#37,  p.  335 

ME  first!  Program 

Also  see  Recommendations  to  more  than  one  ministry — page  120 

Seniors  and  Community  Supports 

2006-07 
vol.  2.  p.  143 

General  computer  controls 

Department  and  PDD 
community  boards 

2003-04 
#8.  p.  107 

Service  pro\  ider  risk  assessment 

Department  and  PDD 
community  boards 

2003-04 
#9.  p.  1 1 1 

Contract  monitoring  and  evaluation 

Department  and  PDD 
community  boards 

2003-04,  p.  109 

Contracting  framework  and  policies 

Also  see  Recommendations  to  more  than  one  ministry— page  120 

Service  Alberta 

2001-02 
#22.  p.  120 

•  2002-03 
#20.  p.  143 

•  2004-05 
#37,  p.  284 

Performance  measures 

2003-04 
#20,  p.  177 

Contracting  policies  and  procedures 

2004-05 
#34,  p.  212 

IT  project  management  of  Registry  Renewal 
Initiative 

2005-06 

#37,  vol.  2,  p.  168 

Phy  sical  security 

2005-06 
vol.  2.  p.  165 

2006-07 
vol.  2,  p.  148 

Security  administration  for  shared  services  at 
distributed  sites 
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Past  recommendations 


Outstanding  recommendations 


Auditee 

Original 
Recommendation 

Repeated 

Recommendation  subject 

2006-07 

#32,  vol.  2,  p.  146 

IT  Service  level  agreements  between  Service 
Alberta  and  its  client  ministries 

2006-07 
vol.  2,  p.  149 

Risk  assessment  for  central  data  centre  assets 

April  2008 
#7,  p.  170 

Guidance  to  implement  IT  control 
frameworks 

October  2008 
#38,  p.  345 

Service  Alberta's  role  as  a  central  processor 
of  transactions 

October  2008 
p.  346 

Access-  and  security-monitoring  of 
application  systems 

October  2008 
p.  348 

Secure  storage  for  confidential  information 
of  Albertans 

October  2008 
p.  349 

System-conversion  process 

Also  see  Recommendations  to  more  than  one  ministry — page  120 

Also  see  Cross-Ministry — page  107 

Solicitor  General  and  Ministry  of  Public  Security 

2006-07 
vol.  2,  p.  154 

Change  Management 

2006-07 
vol.2,  p.  155 

IT  Business  Continuity  Plan 

AGLC 

October  2008 
p.  351 

IT  change  management 

Also  see  Recommendations  to  more  than  one  ministry — page  120 

Sustainable  Resource  Development 

2002-03,  p.  277 

Contracting 

2005-06 

#13,  vol.  l,p.  118 

April  2009 
#4,  p.  52 

Reforestation:  Performance  information. 

2005-06 

#15,  vol.  l,p.  122 

Reforestation:  Monitoring  and  enforcement 

2005-06 
vol.  1,  p.  129 

Reforestation:  Seed  inventory 

2006-07 
vol.  2,  p.  161 

Leases  and  sales 

2006-07 
vol.  2,  p.  162 

Land  sale  agreements  clearly  outline  the 
terms  and  conditions  of  sales  and  conditions 
in  land  sale  and  lease  agreements  are  met 

2006-07 

#33,  vol.  2,  p.  163 

Requests  for  proposals  to  ensure  the  province 
gets  the  best  possible  value  that  can  be 
obtained  given  government  objectives 

2006-07 
vol.  2,  p.  165 

Project  management 

October  2008 
#39,  p.  355 

Controls  over  revenue 

October  2008 
#40,  p.  360 

Enforcement  of  reclamation  obligations 

October  2008 
#41,  p.  362 

Flat  fee  security  deposit 
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f         Past  recommendations  Outstanding  recommendations 


Auditee 

Original 
Recommendation 

Repeated 

Recommendation  subject 

• 

October  2008 
*42.  p.  364 

Royalty  rates  for  sand  and  gravel 

October  2008 
p.  364 

Quantity  of  aggregate  removed 

October  2008 
p.  366 

Information  management 

Natural  Resources 
Conservation  Board 

2003-04 
#28,  p.  294 

2006-07 

#34.  vol.  2.  p.  167 

Natural  Resources  Conservation  Board 
Rank  compliance  and  enforcement  activities 
based  on  risk  (Confined  feeding  operations) 

Also  see  Recommendations  to  more  than  one  ministry — page  120 

Tourism,  Parks  and  Recreation 

Also  see  Recommendations  to  more  than  one  ministry    page  1 20 


Transportation 

2003-04 
#29.  p.  301 

Monitoring  processes  for  commercial  vehicle 
and  motor  vehicle  inspection  programs 

2003-04 
#30.  p.  303 

Licensing  of  commercial  v  ehicle  and  motor 
v  ehicle  inspection  facilities  and  technicians 

Nov  ember  2006 
#5,  p.  24 

Capital  grants  to  Metis  Settlements 

April  2008 

#5  and  #6,  p.  155 

Identifying  and  managing  conflicts  of 
interest  for  contracted  IT  professionals 

Treasury  Board 

1996-97 
#25.  p.  199 

•  1997-98 
#41,  p.  202 

•  1998-99 
#47.  p.  261 

•  1999  00 
#42,  p.  263 

•  2000-01 
#45,  p.  245 

•  2001-02 
#15,  p.  94 

•  2002-03 
#2.  p.  40 

Corporate  gov  ernment  accounting  policies 

2006-07 

HI,  vol.  l.p.  39 

Assessing  and  prioritizing  Alberta's 
infrastructure  needs:  Roles  and 
responsibilities  need  to  be  better  defined  and 
understood 

2006-07 

#2,  vol.  1.  p.  49 

Assessing  and  prioritizing  Alberta's 
infrastructure  needs:  Capital  Plan  needs  to 
reduce  deferred  maintenance  and  consider 
life-cycle  costs 

2006-07 

#3,  vol.  l.p.  54 

Assessing  and  prioritizing  Alberta's 
infrastructure  needs:  Capital  Plan  needs  to 
reduce  deferred  maintenance  and  consider 
life-cycle  costs 
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Past  recommendations 


Outstanding  recommendations 


Auditee 

Original 
Recommendation 

Repeated 

Recommendation  subject 

2006-07 

#4,  vol.  l,p.  57 

Assessing  and  prioritizing  Alberta's 
infrastructure  needs:  Process  to  prioritize 
individual  infrastructure  projects  needs 
improving 

2006-07 

#5,  vol.  1,  p.  59 

Assessing  and  prioritizing  Alberta's 
infrastructure  needs:  Process  to  prioritize 
individual  infrastructure  projects  needs 
improving 

2006-07 
vol.  2,  p.  178 

Inconsistent  budgeting  and  accounting  for 
grants 

October  2008 
#3,  p.  32 

CEO  selection,  evaluation  and 
compensation:  CEO  compensation  disclosure 

October  2008 
p.  371 

Salary  benefits  disclosure 

October  2008 
p.  375 

Report  on  select  payments  to  MLA — Content 
of  Report 

October  2008 
p.  376 

Report  on  select  payments  to  MLAs — 
Efficiency 

October  2008 
p.  377 

Report  on  select  payments  to  MLAs — 
Timely  Reporting 

Also  see  Cross-Ministry — page  107 

Also  see  Recommendations  to  more  than  one  ministry — page  120 

Recommendations  to  more  than  one  ministry 

Culture  and  Community 
Spirit/Tourism,  Parks  and 
Recreation 

2006-07 
vol.  2,  p.  172 

Computer  control  environment 

Food  Safety 

Alberta  Health  Services 

2005-06 

#6,  vol.  l,p.  76 

Food  Safety:  RHA  food  establishment 
inspection  programs 

Alberta  Health  Services 
and  Department  of  Health 
and  Wellness 

2005-06 
vol.  1,  p.  83 

Food  Safety:  Tools  to  promote  and  enforce 
food  safety 

Alberta  Health  Services 
(supported  by  Department 
of  Health  and  Wellness) 

2005-06 

#7,  vol.  l,p.  84 

Food  Safety:  RHA  food  safety  information 
systems 

Alberta  Health  Services 

2005-06 

#8,  vol.  l,p.  87 

Food  Safety:  Compliance  with  permitting 
legislation 

Agriculture  and  Food 

2005-06 

#9,  vol.  l,p.  88 

Food  Safety:  Alberta  Agriculture's 
surveillance  program 

Agriculture  and  Food 

2005-06 

#10,  vol.  1,  p.  91 

Food  Safety:  Alberta  Agriculture's 
inspection  and  investigation  programs 

Agriculture  and  Food 

2005-06 
vol.  l,p.  94 

Food  Safety:  Alberta  Agriculture's  food 
safety  information  systems 

Health  and  Wellness  and 
Agriculture  and  Food  (in 
cooperation  with  Alberta 
Health  Services) 

2005-06 

#11,  vol.  I,  p.  97 

Food  Safety:  Integrated  food  safety  planning 
and  activities 
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Past  recommendations 


Outstanding  recommendations 


Auditee 

Original 
Recommendation 

Repeated 

Recommendation  subject 

Alberta  Health  Sen  ices. 
Department  of  Health  and 
Wellness,  and  Agriculture 
and  Food 

2005-06 
vol  l.p.  102 

Food  Safety:  Fliminating  gaps  in  coverage 

Department  of  Health  and 
Wellness,  and  Agriculture 
and  Food 

2005-06 

#12.  vol.  l.p.  105 

Food  Safety:  Accountability 

Seniors  Care  and  Programs 

Department  of  Health  and 
Wellness  and  Alberta 
Health  Services  (working 
w  itfa  Seniors  and 
Community  Supports ) 

2004-05,  #6.  p.  58 

Seniors  Care  and  Programs,  No.  2— 
page  3 1 :  Compliance  w  ith  Basic  Sen  ice 
Standards 

Department  of  Health  and 
Wellness  and  Alberta 
Health  Services  (working 
w  ith  Seniors  and 
Community  Supports) 

2004-05.  #7.  p.  59 

Seniors  Care  and  Programs.  No.  3 — page  34: 
Fffectiveness  of  serv  ices  in  long-term  care 
facilities 

Department  of  Health  and 
Wellness  and  Alberta 
Health  Services  (working 
w  ith  Seniors  and 
Communitv  Supports) 

 d.  ILL.  '  

2004-05,  #8.  p.  59 

Seniors  Care  and  Programs,  No.  4 — page  35: 
Fffectiveness  of  serv  ices  in  long-  term  care 
facilities 

Department  of  Health  and 
Wellness  and  Alberta 
Health  Services  (working 
w  ith  Seniors  and 
Community  Supports) 

2004-05.  p.  61 

Seniors  Care  and  Programs    page  37: 
Information  to  monitor  compliance  with 
legislation 

Department  of  Health  and 
Wellness  and  Alberta 
Health  Services  (working 
w  ith  Seniors  and 
Community  Supports) 

2004-05.  #9.  p.  62 

Seniors  Care  and  Programs.  No.  5— 
page  39:  Determining  future  needs  for 
services  in  long-term  care  facilities 

Department  of  Health  and 
Wellness 

2004-05,  p.  62 

Seniors  Care  and  Programs — page  39: 
Report  on  progress  implementing  Continuing 
Care  Strategic  Service  Plans 

Seniors  and  Community 
Supports 

2004-05 
#12,  p.  66 

Seniors  Care  and  Programs.  No.  8: 

1  ■  fleet iv  eness  of  Seniors  1  odtic  Program 

Seniors  and  Community 
Supports 

2004-05,  p.  67 

Seniors  Care  and  Programs    page  50: 
Determining  future  needs 

Seniors  and  Community 
Supports 

2004-05.  p.  68 

Seniors  Care  and  Programs — page  55: 
Fffectiv  eness  of  the  Alberta  Seniors  Benefit 
Program 

Seniors  and  Community 
Supports 

2004-05 
#13,  p.  69 

Seniors  Care  and  Programs.  No.  9 — page  56: 
Information  to  determine  program  benefits 
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Past  recommendations 


Outstanding  recommendations 


Auditee 

Original 
Recommendation 

Repeated 

Recommendation  subject 

Protecting  information  assets 

Executive  Council 

October  2008 
#4,  p.  53 

Protecting  information  assets:  Central 
Security  Office 

Service  Alberta  with  all 
ministries 

October  2008 
p.  64 

Protecting  information  assets:  Develop  and 
maintain  detailed  standards  and  policies  to 
build  and  operate  secure  web  applications 

Service  Alberta  with  all 
ministries 

October  2008 
#5,  p.  66 

Protecting  information  assets:  Develop 
standards  and  policies  to  ensure  web 
applications  are  built  to  required  standards 

Service  Alberta  with  all 
ministries 

October  2008 
#6,  p.  68 

Protecting  information  assets:  Review  and 
improve  the  GoA's  shared  computing 
infrastructure  policies,  procedures,  and 
standards 

Service  Alberta  with  all 
ministries 

October  2008 
p.  75 

Protecting  information  assets:  Wireless 
policies  and  standards 

Service  Alberta  with  all 
ministries 

October  2008 
p.  76 

Protecting  information  assets:  Device 
configurations 

Service  Alberta  with  all 
ministries 

October  2008 
#  7,  p.  77 

Protecting  information  assets:  Ongoing 
monitoring  and  surveillance 

Service  Alberta  and  the 
Ministry  of  Infrastructure 

October  2008 
p.  84 

Protecting  information  assets:  Increasing 
collaboration  by  ministries 

Service  Alberta  with  all 
ministries 

October  2008 
p.  85 

Protecting  information  assets:  Backup  power 
supplies 

Service  Alberta  with  the 
Ministry  of  Infrastructure 

October  2008 
#8,  p.  87 

Protecting  infonnation  assets:  Physical 
security 

Service  Alberta  with  all 
ministries 

October  2008 
p.  89 

Protecting  information  assets:  Environmental 
security 

Sustainable  Resource  and  Environmental  Management  (SREM) 

Energy,  Environment  and 
Sustainable  Resource 
Development 

2004-05 
#14,  p.  72 

Sustainable  Resource  and  Environmental 
Management  (SREM)  Implementation  Plan 
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Outstanding  recommendations 


Numbered  recommendations  more  than  three  years  old 

We  currently  have  300  outstanding  recommendations  1 50  are  numbered  and  I  50  are  unnumbered.  We 
use  three  years  as  a  performance  measure  for  w  hen  we  expect  management  to  implement  our  numbered 
recommendations.  The  follow  ing  table  show  s  the  status  of  numbered  recommendations  more  than  three 
years  old.  Currently,  there  are  41  numbered  recommendations  that  are  not  yet  implemented,  or  have  not 
yet  been  confirmed  by  our  Office  as  implemented. 


Total  numbered 
recommendations1 


Fully 
Implemented 


Not  yet 
implemented 


1 996-  1997 

1997-  1998 

1998-  1999 

1999-  2000 
2000  2001 
2001-2002 
2002  2003 
2003-2004 
2004  20052 


26 
47 
28 
33 
26 
26 
26 
24 
46 


25 
46 
26 
32 
24 
21 
22 
14 
31 


2 
I 

2 
5 
4 

10 
15 


41 


Excludes  repeated  recommendations 
"  Three  public  reports  released  in  October  2005:  2004  2005  Annual  Report.  Alberta  Securities  Commission's  Enforcement 
System,  and  Alberta  Social  Housing  Corporation — Land  Sales  Systems. 
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xccountahilitv 


Accrual  basis  of 
accou  ating 

Adverse  auditor's  opinion 
Assu  ranee 


Attest  work,  attest  audit 
Audit 

Auditor 

Auditor's  opinion 
Auditor's  report 
Business  case 


(  apital  asset 

Criteria 
C'ross-ministrv 

Crow  n 

De  fe  rred  maintenan  ce 
Exception 


Glossary 


This  glossary  explains  kev  accounting  terms  and  concepts  in  this  report 

Responsibility  for  the  consequences  of  actions.  In  this  report.  </<  c ounlnhilii\  requires 
ministries,  departments  and  other  entities  to: 

•  report  their  results  (what  they  spent  and  w  hat  they  achieved)  and  compare  them  to 
their  goals 

•  explain  any  differences  between  their  goals  and  results 

Government  accountability  allows  A  Iberians  to  decide  whether  the  government  is  doing  a 
good  job.  They  can  compare  the  costs  and  benefits  of  government  action:  what  it  spends, 
what  it  tries  to  do  (goals),  and  what  it  actually  does  (results). 

A  way  of  recording  financial  transactions  that  puts  rev  enues  and  expenses  in  the  period 
w  hen  they  are  earned  and  incurred. 

An  auditor's  opinion  that  financial  statements  are  not  presented  fairly  and  are  not  reliable. 

An  auditor's  w  ritten  conclusion  about  something  audited.  Absolute  assurance  is  impossible 
because  of  several  factors,  including  the  nature  of  judgment  and  testing,  the  inherent 
limitations  of  control,  and  the  fact  that  much  of  the  evidence  available  to  an  auditor  is  only 
persuasiv  e,  not  conclusive. 

Work  an  auditor  does  to  express  an  opinion  on  the  reliability  of  financial  statements. 

An  auditor's  examination  and  v  erification  of  ev  idence  to  determine  the  reliability  of 
financial  information,  to  evaluate  compliance  w  ith  law  s,  or  to  report  on  the  adequacy  of 
management  systems,  controls  and  practices. 

A  person  who  examines  systems  and  financial  information. 

An  auditor's  w  ritten  opinion  on  w  hether  things  audited  meet  the  criteria  that  apply  to  them. 
An  auditor's  w  ritten  communication  on  the  results  of  an  audit. 

An  assessment  of  a  project's  financial,  social  and  economic  impacts.  A  business  case  is  a 
proposal  that  analy  ses  the  costs,  benefits  and  risks  associated  w  ith  the  proposed 
investment,  including  reasonable  alternatives.  The  province  has  issued  business  case  usage 
guidelines  and  a  business  case  template  that  the  Department  can  refer  to  in  establishing  its 
business  case  policy. 

A  long-term  asset. 

Reasonable  and  attainable  standards  of  performance  that  auditors  use  to  assess  systems. 

The  section  of  this  report  covering  systems  and  problems  that  affect  sev  eral  ministries  or 
the  w  hole  gov  eminent. 

The  Gov  ernment  of  Alberta. 

Any  maintenance  work  not  performed  when  it  should  be.  Maintenance  work  should  be 
performed  w  hen  necessary  to  ensure  capital  assets  prov  ide  acceptable  sen  ice  over  their 
expected  lives. 

Something  that  does  not  meet  the  criteria  it  should  meet — see  "Auditor's  opinion". 
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Reference 


Glossary 


Expense 

GAAP 

Governance 
Internal  audit 


Internal  control 


Management  letter 


Material,  materiality 

Misstatement 

Outcomes 

Performance  measure 
Performance  reporting 
Performance  target 
Qualified  auditor's  opinion 

Recommendation 

Risk 

Risk  management 
Securitization 


The  cost  of  a  thing  over  a  specific  time. 

Abbreviation  for  "generally  accepted  accounting  principles",  which  are  established  by  the 
Canadian  Institute  of  Chartered  Accountants. 

A  process  and  structure  that  brings  together  capable  people  and  relevant  information  to 
achieve  goals.  Governance  defines  an  organization's  accountability  systems  and  ensures 
the  effective  use  of  public  resources. 

A  group  of  auditors  within  a  ministry  (or  an  organization)  that  assesses  and  reports  on  the 
adequacy  of  the  ministry's  internal  controls.  The  group  reports  its  findings  directly  to  the 
deputy  minister.  Internal  auditors  need  an  unrestricted  scope  to  examine  business 
strategies;  internal  control  systems;  compliance  with  policies,  procedures,  and  legislation; 
economical  and  efficient  use  of  resources;  and  the  effectiveness  of  operations. 

A  system  designed  to  provide  reasonable  assurance  that  an  organization  will  achieve  its 
goals.  Management  is  responsible  for  an  effective  internal  control  system  in  an 
organization,  and  the  organization's  governing  body  should  ensure  that  the  control  system 
operates  as  intended.  A  control  system  is  effective  when  the  governing  body  and 
management  have  reasonable  assurance  that: 

•  they  understand  the  effectiveness  and  efficiency  of  operations 

•  internal  and  external  reporting  is  reliable 

•  the  organization  is  complying  with  laws,  regulations,  and  internal  policies 

Our  letter  to  the  management  of  an  entity  that  we  have  audited.  In  the  letter,  we  explain: 

1 .  our  work 

2.  our  findings 

3.  our  recommendation  of  what  the  entity  should  improve  and  how  it  should  do  so 

4.  the  risks  if  the  entity  does  not  implement  the  recommendation 

We  also  ask  the  entity  to  explain  specifically  how  and  when  it  will  implement  the 
recommendation. 

Something  important  to  decision-makers. 

A  misrepresentation  of  financial  information  due  to  mistake,  fraud,  or  other  irregularities. 
The  results  an  organization  tries  to  achieve  based  on  its  goals. 
Indicator  of  progress  in  achieving  a  goal. 

Reporting  on  financial  and  non-financial  performance  compared  to  plans. 
The  expected  result  for  a  performance  measure. 

An  auditor's  opinion  that  things  audited  meet  the  criteria  that  apply  to  them,  except  for  one 
or  more  specific  areas — which  cause  the  qualification. 

A  solution  we — the  Office  of  the  Auditor  General  of  Alberta — propose  to  improve  the  use 
of  public  resources  or  to  improve  performance  reporting  to  Albertans. 

Anything  that  impairs  an  organization's  ability  to  achieve  its  goals. 

Identifying  and  then  minimizing  or  eliminating  risk  and  its  effects. 

Is  a  financial  transaction,  which  involves  the  pooling  and  repackaging  of  cash-flow 
producing  financial  assets  into  securities  that  are  then  sold  to  investors. 
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Specified  auditing 
procedures 


Sj  stems  i  management ) 


Systems  (accounting) 


S\  stems  audit 


Glossary 


-r 


Actions  an  auditor  performs  to  check  certain  qualities,  such  as  reliability  of  reported 
information  that  management  asks  the  auditor  to  check.  Specified  auditing  procedures  are 
not  extensive  enough  to  allow  the  auditor  to  express  an  opinion  on  the  information. 

A  set  of  interrelated  management  control  processes  designed  to  achieve  goals 
economical  l\  and  efficiently. 

A  set  of  interrelated  accounting  control  processes  for  revenue,  spending,  the  preservation 
or  use  of  assets,  and  the  determination  of  liabilities. 

To  help  improve  the  use  of  public  resources,  we  audit  and  recommend  improvements  to 
systems  designed  to  ensure  v  alue  for  money. 

Paragraphs  (d)  and  (e)  of  subsection  19(2)  of  the  Auditor  (ieneral  Act  require  us  to  report 
every  case  in  which  we  observe  that: 

•    an  accounting  system  or  management  control  system,  including  those  designed  to 
ensure  economy  and  efficiency,  w  as  not  in  existence,  or  w  as  inadequate  or  not 
complied  vv  ith.  or 

appropriate  and  reasonable  procedures  to  measure  and  report  on  the  effectiveness  of 
programs  were  not  established  or  complied  with. 

To  meet  this  requirement,  w  e  do  systems  audits.  Systems  audits  are  conducted  in 
accordance  with  the  assurance  and  value-for-money  auditing  standards  established  bv  the 
Canadian  Institute  of  Chartered  Accountants. 

First,  we  develop  criteria  that  a  system  or  procedure  should  meet.  We  always  discuss  our 
proposed  criteria  with  management  and  try  to  gain  their  agreement  to  them.  Then  w  e  do 
our  work  to  gather  audit  ev  idence. 

Next,  we  match  our  ev  idence  to  the  criteria.  If  the  audit  ev  idence  matches  all  the  criteria, 
we  conclude  the  system  or  procedure  is  operating  properly.  But  if  the  ev  idence  doesn't 
match  all  the  criteria,  we  have  an  audit  finding  that  leads  us  to  recommend  what  the 
ministry  must  do  to  ensure  that  the  system  or  procedure  will  meet  all  the  criteria. 

For  example,  if  we  have  5  criteria  and  a  system  meets  3  of  them,  the  2  unmet  criteria  lead 
to  the  recommendation. 


I  nqualified  auditor's 
opinion 

Value  for  moncv 


A  systems  audit  should  not  be  confused  with  assessing  systems  w  ith  a  view  to  relying  on 
them  in  an  audit  of  financial  statements. 

An  auditor's  opinion  that  things  audited  meet  the  criteria  that  apply  to  them. 


The  concept  underlying  a  systems  audit  is  value  for  money.  It  is  the  "bottom  line"  for  the 
public  sector,  analogous  to  profit  in  the  priv  ate  sector.  The  greater  the  v  alue  added  bv  a 
government  program,  the  more  effective  it  is.  The  fewer  resources  that  are  used  to  create 
that  v  alue,  the  more  economical  or  efficient  the  program  is.  "Value"  in  this  context  means 
the  impact  that  the  program  is  intended  to  achieve  or  promote  on  conditions  such  as  public 
health,  highw  ay  safety,  crime,  or  farm  incomes.  To  help  improve  the  use  of  public 
resources,  we  audit  and  recommend  improv  ements  to  systems  designed  to  ensure  v  alue  for 
money. 


Other  resources 

The  Canadian  Institute  of  Chartered  Accountants  (CICA)  produces  a  useful  book  called.  Terminology  for  Accountants.  They 
can  be  contacted  at  CICA,  277  Wellington  Street  West.  Toronto.  Ontario.  Canada  M5V  3H2  or  www.cica.ca. 
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